Code On Time: Security

Blog

Security

Tuesday, June 4, 2013Print Subscribe

Code On Time web apps automatically include a dropdown login box pictured below when membership is enabled. As an alternative, a dedicated login page may be created. Learn more about the dropdown login box and dedicated login page.

Sometimes it may be necessary to place the login control on another page. This can be easily done by adding the <asp:Login /> control to any .aspx page.

Let’s place a login control on the home page. Start the web app generator, click on the project name, and press Develop to open the project in Visual Studio. In the Solution Explorer, double-click on ~\Pages\Home.aspx.

Notice that there are two <asp:Content> elements in the page. Append the highlighted line to the end of the second element.

<%@ Page Language="C#" MasterPageFile="~/Main.Master" AutoEventWireup="true" 
    CodeFile="Home.aspx.cs" Inherits="Pages_Home" Title="^HomeTitle^Start^HomeTitle^" %>

<%@ Register Src="../Controls/TableOfContents.ascx" TagName="TableOfContents" TagPrefix="uc" %>
<%@ Register Src="../Controls/Welcome.ascx" TagName="Welcome" TagPrefix="uc" %>
<asp:Content ID="Content1" ContentPlaceHolderID="PageHeaderContentPlaceHolder" runat="Server">
    ^HomeTitle^Start^HomeTitle^
</asp:Content>
<asp:Content ID="Content2" ContentPlaceHolderID="PageContentPlaceHolder" runat="Server">
    <div factory:flow="NewRow" xmlns:factory="urn:codeontime:app-factory">
        <uc:TableOfContents ID="control1" runat="server"></uc:TableOfContents>
    </div>
    <div factory:flow="NewColumn" xmlns:factory="urn:codeontime:app-factory">
        <uc:Welcome ID="control2" runat="server"></uc:Welcome>
    </div>
    <asp:Login runat="server" />
</asp:Content>

Save the file, and press F5 to open the web site in a browser window. The standard login control will be present at the bottom of the page.

Labels: Application Builder, Security, Web Application Generator

Friday, January 4, 2013Print Subscribe

Displaying Current User Name as a Virtual Field

Suppose that you need to display the name of the current user. Let’s implement a virtual field that will display the current user name on the Customers form.

Start the Project Designer. In the Project Explorer, switch to the Controllers tab. Right-click on Customers / Fields node, and press New Field.

Use the following values:

Property	Value
Name	CurrentUserName
Type	String
Length	40
Allow null values.	true
The value of this field is computed at run-time by SQL expression.	true
SQL Formula	@BusinessRules_UserName
Label	Current User
Values of this field cannot be edited.	true

Press OK to save.

Let’s add this field to the edit form. Drop Customers / Fields / CurrentUserName (String(40)), read-only) node onto Customers / Views / editForm1 node. This will instantiate a CurrentUserName data field.

On the toolbar, press Browse. Navigate to the Customers page and select a record. The Current User data field will display the user name at the bottom of the form.

Log out, and log in as user / user123%. The current user will change to reflect the current user account.

Labels: Application Builder, Security, User Interface, Web Application Generator

Thursday, January 3, 2013Print Subscribe

Restrict Access to Fields with “Roles” Properties

The Read Roles and Write Roles properties for a field allow specifying a list of roles. Users that do not have a role in the list will not be able to view or edit the field, respectively.

Let’s prevent non-administrators from editing the Phone field in Customers controller or viewing the Address fields.

Controlling Editing Rights for Phone Field

Start the Project Designer. In the Project Explorer, switch to the Controllers tab. Double-click on Customers / Fields / Phone node.

Change the Write Roles property:

Property	New Value
Write Roles	Administrators

Press OK to save.

Controlling Visibility for Address Fields

Double-click on Customers / Fields / Address (String(60)) node.

Change the following:

Property	New Value
Read Roles	Administrators

Press OK to save. Make the same change to these fields as well: City, Region, PostalCode, Country.

Viewing the Results

On the toolbar, press Browse.

Log in with the standard user account (user / user123%) and navigate to the Customers page. Note that none of the address fields are displayed in the grid.

Select a record and start editing. Note that the Phone field is read-only.

Log out, and log in again with the administrative account (admin / admin123%). Start editing a record – Phone and Address fields will be editable.

Labels: Application Builder, Security, User Interface, Web Application Generator