Webform_DoCallback - security?

  • Thread starter Thread starter cityzen.2000
  • Start date Start date
C

cityzen.2000

Hello all

I have a web page that has a bunch of links implemented in Javascript,
each of which calls back to the code-behind page via a
Webform_DoCallback call.

My problem is this:
When I am developing locally and using the local web server to debug,
the callbacks are working fine.

When I deploy to our dev web server, the callbacks work fine if I log
on to the dev web server and access the site from there.

However if I try to access the site from a different computer (in the
same domain), the callbacks are not firing.

I've added the dev web server to the list of trusted sites on the
different computer from where I'm accessing the site.

Any ideas as to why this isn't working?

Thanks
 
Hi,

I don't think that javascript has been turned off. I've extracted the
WebForm_DoCallback call out to a separate function and called this
function in the links' onClick() event. The call to WebForm_DoCallback
has been surrounded by alert() s and enclosed in a try...catch block
and still no error is occurring: the alerts all fire and no exception
is caught - it's as if the call is simply ignored. I'm struggling with
this...

The code below causes the following messages to display in alert()s

ktemptestcalled...
<value in UWBranch.abbr>
Webform_DoCallback call over
Leaving ktemptest...

with no errors shown - and only when I'm accessing the site from a
different computer. This code works when using Visual Studio's
development server, and also when I log on to the web server that the
site's deployed on and open a browser window there. So it seems like
some sort of security or permissions thing?

<Server Side>
UWBranch.Attributes["onclick"] = String.Format("javascript:{0}",
"ktemptest()");

<Client Side>
function ktemptest()
{
alert('ktemptest called...');

try
{
alert(document.all['UWBranch'].abbr);

WebForm_DoCallback('__Page',document.all['UWBranch'].abbr,ClientCallbackScript,null,null,false);
alert('Webform_DoCallback call over');
}
catch(e)
{
alert('Webform_DoCallback exception: ' + e);
}

alert('Leaving ktemptest...');
}
 
Howdy,

I'm not sure if this is the case, but i suspect you just amended rendered
script for another control by viewing HTML source, which is not clever idea.
ClientScriptManager class contains everything you need:


public partial class Default2 : System.Web.UI.Page, ICallbackEventHandler
{
protected void Page_Load(object sender, EventArgs e)
{
string arg = String.Format("document.getElementById('{0}').abbr",
UWBranch.ClientID);
string postbackCall = ClientScript.GetCallbackEventReference(this, arg,
"null", "null");

ClientScript.RegisterClientScriptBlock(
this.GetType(),
"MyTestScript",
String.Format(TestScript, UWBranch.ClientID, postbackCall));
}

private const string TestScript =

"function ktemptest()\n" +
"{\n" +
" alert('ktemptest called...');\n" +
" try\n" +
" {\n" +
" alert(document.getElementById('{0}').abbr);\n" +
" {1};\n" +
" alert('Webform_DoCallback call over');\n" +
" }\n" +
" catch(e)\n" +
" {\n" +
" alert('Webform_DoCallback exception: ' + e);\n" +
" }\n" +
" alert('Leaving ktemptest...');\n" +
"}";


public string GetCallbackResult()
{
return string.Empty;
}
public void RaiseCallbackEvent(string eventArgument)
{
// do something with abbr vaue here
}
}

In addition, you used control.ID for the server control (runat=server). It
may accidently work, but DO NOT use it. If you embeded UWBranch control in a
panel or any container, ID rendered to the client would be different. It
would include IDs of all parent controls. Control.ClientID in conjunction
with docuemnt.getElementById() client script is recommended combination. I
can't think of any other reasons, apart from turning js to off which is
definitely not the case.

--
Milosz


[email protected] said:
Hi,

I don't think that javascript has been turned off. I've extracted the
WebForm_DoCallback call out to a separate function and called this
function in the links' onClick() event. The call to WebForm_DoCallback
has been surrounded by alert() s and enclosed in a try...catch block
and still no error is occurring: the alerts all fire and no exception
is caught - it's as if the call is simply ignored. I'm struggling with
this...

The code below causes the following messages to display in alert()s

ktemptestcalled...
<value in UWBranch.abbr>
Webform_DoCallback call over
Leaving ktemptest...

with no errors shown - and only when I'm accessing the site from a
different computer. This code works when using Visual Studio's
development server, and also when I log on to the web server that the
site's deployed on and open a browser window there. So it seems like
some sort of security or permissions thing?

<Server Side>
UWBranch.Attributes["onclick"] = String.Format("javascript:{0}",
"ktemptest()");

<Client Side>
function ktemptest()
{
alert('ktemptest called...');

try
{
alert(document.all['UWBranch'].abbr);

WebForm_DoCallback('__Page',document.all['UWBranch'].abbr,ClientCallbackScript,null,null,false);
alert('Webform_DoCallback call over');
}
catch(e)
{
alert('Webform_DoCallback exception: ' + e);
}

alert('Leaving ktemptest...');
}
Click to expand...
 
Back
Top