Code Luck

Here is how you do it.

   20     private enum ReportTypes : int

   21     {

   22         ByVendor = 1,

   23         ByCategory = 2,

   24         ByType = 3

   25     }
   35     protected void Page_Load(object sender, EventArgs e)

   36     {

   37         if (!IsPostBack)

   38         {

   44             ddlReportTypes.DataSource = Enum.GetNames(typeof(ReportTypes));
   45             ddlReportTypes.DataBind();

   46         }

   47     }

   48     protected void ddlReportTypes_SelectedIndexChanged(object sender, EventArgs e)

   49     {

   50         ReportTypes rType =

   51             (ReportTypes)Enum.Parse(typeof(ReportTypes), ddlReportTypes.SelectedValue);

   52         switch (rType)

   53         {

   54             case ReportTypes.ByVendor:

   56                 break;

   57             case ReportTypes.ByCategory:                

   60                 break;

   61             case ReportTypes.ByType:

   62                 break;

   63         }

   64     }

  10 <configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">

Removing the xmlns attribute from the configuration tag brings back the intellisense for the Web.Config.

  10 <configuration>

I saw this on one of the dnrtv shows, so credit goes to the author Miguel Castro.

 Recently I was put on a project that needed to harness the built in windows security for user authentication. Idea was to allow access only tousers of subscribed to certain groups. Once authenticated, based on the group the user is subscribed to, I needed to perform custom actions. 

We deny access to anonymous users. Also, with the "Impersonate clause" we tell ASP.NET

to run using the permission/priveledges of the authenticated user

instead of the default asp_net user.

   37         authentication mode="Windows"        

   38         authorization

   39             allow roles="MSDomain\Buyers,MSDomain\Clerks,MSDomain\Receivers"

   40             deny users="*"            

   41         authorization

   42         identity impersonate="true"        

In order to be able to find out whether a user belongs to a particular group and to get a list of groups a user is subscribed to, we needed to

specify a "roleManager" config section and set the default provider to "AspNetWindowsTokenRoleProvider". Until this is done, the any code written

to check whether the user is part of a group/list of groups will not work.

"Role Manager" helps us manage groups(roles) and perform group based authorization

in the applicaion. We need the role manager to help us identify the groups of which the authenticated user is a part of and perform actions like wise.

Msdn article about role management says:

"The main benefits of using role manager are that it allows you to look up users' roles without writing and maintaining code. Additionally, the 

role providers offer a consistent way for you to check the role membership of your users, regardless of the underlying data store. Therefore, 

if your role store were to change tomorrow, you would only need to change the configuration settings to make your code work."

 roleManager enabled="true" defaultProvider="WindowsTokenRoleProvider" >

The default role providers are as follows:

1. SqlRoleProvider
 - role information kept in SQL Server
2. WindowsTokenRoleProvider
 - read-only provider that retrieves role information for a 
   Windows user account based on the account's Windows security 
   group membership
3. AuthorizationStoreRoleProvider
 - used if your application uses Authorization Manager (AzMan)In my case, all I needed was to redirect user to corresponding portion of the site depending on their role, hence read-only role provider was

sufficient.

Msdn article says "The Windows security system acts as role store for this 

provider, so no additional configuration is required to set up the role store"

Once the user is authenticated, we need to check if the user is part of a particular group, if yes, then perform the custom action.

Below is the code required to validate whether a user is part of a inranet group.

  120         if (User.IsInRole   (WindowsGroupSettings.SettingFor.Buyers))

  121         {

  122             if (this.LoadPricesForBuyer != null)

  123             {

  124                 _buyerName = User.Identity.Name;

  125                 LoadPricesForBuyer(this, EventArgs.Empty);

  126             }

  127         }

  140         if (!IsPostBack)

  141         {

  142             gvRoles.DataSource = Roles.GetRolesForUser(User.Identity.Name);

  143             gvRoles.DataBind();

  149         }

  319         asp:FormView ID="fvExceptionDetails" runat="server"/asp:

  320         AllowPaging="true" DataKeyNames="Oid" 

  321         OnModeChanging="fvExceptionDetails_ModeChanging" 

  322         OnPageIndexChanging="fvExceptionDetails_PageIndexChanging" 

  323         OnItemUpdating="fvExceptionDetails_ItemUpdating">

  324             ItemTemplate

  325             /ItemTemplate

  326             EditTemplate

  327             /EditTemplate

  328         FormView>

  261     protected void fvExceptionDetails_PageIndexChanging(object sender, 

  262         FormViewPageEventArgs e)

  263     {

  264         fvExceptionDetails.PageIndex = e.NewPageIndex;

  265         DataBindExceptionDetails();

  266     }

This event is called before any state is restored from the
client response. It is used to prepare the Page for processing the request. Dynamic controls can be added in this event.

Child controls are created between this event and the "InitComplete" event if it is a postback. Also, Control/View State is loaded if it is a postback.

  279     protected override void OnInit(EventArgs e)

  280     {

  281         timeOut = Server.ScriptTimeout;

  282         // Give it 5 hour = (3600 * 5) = 18000 seconds

  283         Server.ScriptTimeout = 18000;

  284     }

  430         /// 

  431         /// Queries the information schema to find whether a table exists or not

  432         /// 

  433         /// 

  434         /// 

  435         private bool TableExists(string table)

  436         {

  437             bool retAnswer = false;

  438             try

  439             {

  440                 int exist = (int)ConnectionManager.DBInfoConnection.ExecuteScalar(

  441                     "SELECT count(*) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_NAME='" + table + "'");

  442                 if (exist == 1)

  443                     retAnswer = true;

  444             }

  445             catch (Exception ex)

  446             {

  447                 GenericLogger.Error("Could not query database for list of tables", ex);

  448             }

  449             return retAnswer;

  450         }

Please ignore the non use of SqlParameters. I had to add this as a maintainence method in an 

2-3 years old app and when you have to decide between your urge to make drastic(essential) 

changes to a system and the number of hours that have been alotted 

to this task, I think pragmatism wins.

Here is what I use to sanitize my text input before inserting into DB. Most of the code is from a msdn article on how to avoid sql injection attacks.

   29         /// 

   30         /// make search text input sql safe.

   31         /// 

   32         /// 

   33         /// 

   34         private static string SafeSqlLikeClauseLiteral(string inputSQL)

   35         {

   36             // Make the following replacements:

   37             // '  becomes  ''

   38             // [  becomes  [[]

   39             // %  becomes  [%]

   40             // _  becomes  [_]

   41 

   42             string s = inputSQL;

   43             s = inputSQL.Replace("'", "''");

   44             s = s.Replace("[", "[[]");

   45             s = s.Replace("%", "[%]");

   46             s = s.Replace("_", "[_]");

   47             return s;

   48         }

   49         /// 

   50         /// make text input sql safe

   51         /// 

   52         /// 

   53         /// 

   54         private static string SafeSqlLiteral(string inputSQL)

   55         {

   56             return inputSQL.Replace("'", "''");

   57         }

   58         /// 

   59         /// convert '' to ' when returning to the user, Remember, only to be used

   60         /// when returning strings to user.

   61         /// 

   62         /// 

   63         /// 

   64         private static string Desanitize(string output)

   65         {

   66             return output.Replace("''", "'");

   67         }

   72 // JScript File

   73 //javascript left & right trim similar to stringObj.Trim() in C#

   74 function trimAll(sString)

   75 {

   76     while (sString.substring(0,1) == ' ')

   77     {

   78         sString = sString.substring(1, sString.length);

   79     }

   80     while (sString.substring(sString.length-1, sString.length) == ' ')

   81     {

   82         sString = sString.substring(0,sString.length-1);

   83     }

   84     return sString;

   85 }

   84     /// <summary>

   85     /// This overriden method helps handle Session timeouts.

   86     /// </summary>

   87     /// <param name="e"></param>

   88     override protected void OnInit(EventArgs e)

   89     {

   90         base.OnInit(e);

   91 

   92 

   93         //It appears from testing that the Request and Response both share the 

   94         // same cookie collection.  If I set a cookie myself in the Reponse, it is 

   95         // also immediately visible to the Request collection.  This just means that 

   96         // since the ASP.Net_SessionID is set in the Session HTTPModule (which 

   97         // has already run), thatwe can't use our own code to see if the cookie was 

   98         // actually sent by the agent with the request using the collection. Check if 

   99         // the given page supports session or not (this tested as reliable indicator 

  100         // if EnableSessionState is true), should not care about a page that does 

  101         // not need session

  102         if (Context.Session != null)

  103         {

  104             //Tested and the IsNewSession is more advanced then simply checking if 

  105             // a cookie is present, it does take into account a session timeout, because 

  106             // I tested a timeout and it did show as a new session

  107             if (Session.IsNewSession)

  108             {

  109                 // If it says it is a new session, but an existing cookie exists, then it must 

  110                 // have timed out (can't use the cookie collection because even on first 

  111                 // request it already contains the cookie (request and response

  112                 // seem to share the collection)

  113                 string szCookieHeader = Request.Headers["Cookie"];

  114                 if ((null != szCookieHeader) && (szCookieHeader.IndexOf("ASP.NET_SessionId") >= 0))

  115                 {

  116                     //string url = "~/Default.aspx?x=" + RedirectMessage("Session Timed out.");

  117                     //Response.Redirect(url);

  118                     Session["TimeoutMessage"] = "Your Session timed out";

  119                     Response.Redirect("~/Default.aspx");

  120                 }

  121             }

  122         }

  123     }