Does a stored password Break the ASP.NET CompareValidator? - c#

I am trying to create a registration page for my company, and so I put down Password and "Repeat Password" textboxes on my form, along with a CompareValidator. It appears to work just fine, whenever users go into both fields, type data and click the Register/Submit button.
However, I've noticed an issue where my Firefox browser during testing saves a password that I entered. After it's saved the password, if I then go back to the page "fresh", it shows the password already filled in the Password field (though not in the "Repeat Password" field for some reason).
Anyways, if I then populate the e-mail address, I can then click the Register/Submit button with no issues at all!
The most concerning thing is, when I debug into the CodeBehind and even force a validation by triggering both the control's Validate method and the Page's Validate method manually, it still somehow PASSES the validation even though, as you can see in the QuickWatches in my screenshot below, the fields have two different values!
Have I found a bug that I should report to Microsoft, or is it possible that I did something wrong in setting this all up? All I did was plop the CompareValidator on the form, and set the "ControlToCompare" to "txtUserPass" and the "ControlToValidate" to "txtRepeatPass", and the Operation is set to "Equal".
Am I perhaps doing something wrong here, or have I found a genuine bug caused by browsers storing passwords?

As specified on the documentation, the CompareValidator does not trigger for empty values:
If the input control is empty, no validation functions are called and validation succeeds.
Use a RequiredFieldValidator control to require the user to enter data in the input control.
You need to combine the CompareValidator with a RequiredFieldValidator.

Related

Why do only the first two validators trigger on my ASP.NET C# website?

I have a form that asks a user for their first name, last name, phone number, ID number, username, and check boxes to choose either faculty or student in that order. The first two text boxes have two validators each, a regular expression: ^[a-zA-Z- ]*$ and required field validator. After that I created some custom validators as in addition to the text box for phone number, ID number, and username I have a "Don't know?" checkbox in case they forgot. So it validates to make sure they either typed in something and if not to make sure the check box is checked. Now, if I fire up the site and simply click the confirm button only the first two fields trigger their validation, that is the first and last name fields. Now, if I put in a first and last name and click confirm button again the rest of the validators trigger as normal. How can I get them to all trigger at once? Thanks.
Your custom validator logic may be implemented only in server side. You may have to provide the validation logic at client side by writing a javascript method and specifying it in ClientValidationFunction property. The link also provides an example on how to implement it in the client side.

control textboxes to save typed data

I am writing asp.net C# project and testing this in Chrome browser.
The page consists several textboxes: one for user name, one for email, one for phone, password, etc.
I run the project and fill textboxes. Next time when I start typing in userName textbox all the previously typed words including email,address, phone.. start to appear as hint under the textbox, for example, like in the following picture(but this is not exactly in my project):
Suppose that stack overflow is username typed before in this textbox, and stackhash_0a9e is useraddress typed before in address textbox. I want that stackkash_0a9e will not appear in this textbox, this should appear in textbox for address when user is typing there.
Is there solution of this, if so how?
Thanks
Textbox only shows that data which is entered in it, I don't know why your username textbox is also showing useraddress, probably you had entered useraddress in the username textbox. The textbox retains the previous value due to viewstate. You can disable the viewstate but it will stills shows you the previous data bcz it was also cached in browser.
To disable the cache Add the ViewStateMode to your textbox and set it to ViewStateMode="Disabled" ViewStateMode is only available in .net 4
<asp:TextBox ID="TextBox1" runat="server" ViewStateMode="Disabled"></asp:TextBox>

Don't post back textbox

I have a fairly complex form (user control actually) with one textbox control on it that needs to NOT post back. Is there a way to remove a control from the post? Yes, this textbox is editable.
More info: This is for a credit card processing form, so the "final" submit will post to another site's page. However, prior to this there is plenty of server-side processing that goes on. I know that I can move the the credit card number text box to another page - but this requirement came very late and I'll trying to not have to re-work a lot of things.
The easiest way would be to use an html input as opposed to an ASP TextBox. These are not accessible from code if runat="server" is not set on them.
Or use the viewstate property (http://msdn.microsoft.com/en-us/library/system.web.ui.control.enableviewstate.aspx)
So the situation is that you have a form that is rendered in the user's browser with an action pointing to a different site and you need to make sure that one of the form fields will not be sent when the form is submitted.
Sounds to me like you cannot in that case make absolutely sure that the value is not posted. There are many different possible ways to solve this using javascript (disable input, clear value, etc before submit) but if scripting is turned off I think you're out of luck.
But since you can prepare for sending the form to the other server (change action on form or enable button with PostBackUrl), I guess you could also then set the Enabled property on the textbox to false. That would mean that it can no longer be edited on the final page beforr posting to the other server. Or you could hide the textbox a (so it's not renered at all) and show the field as a label or literal instead.
But even then you still have to somehow make sure the secret value is not included in the viewstate of the form. Which it will be in case you use a label or literal. And also for a textbox that was disabled or hidden on the last postback. Normally the viewstate is just a base64 encoded string so it would be trivial to find the credit card number from there. You could probably fix this by turning off viewstate for the control in question (or even for the whole page) in the last post back to your page before setting the form up for posting to the other server.
If you cannot tell for sure which will be the last postback to your server, then I think you're out of luck without more significant changes. Sorry to be a downer. Some seemingly trivial things are just hard with Asp.Net web forms.
Maybe you could add a separate page that you populate with just the data that you need to send to the other server and have that a sort of "Confirmation page". In that page you could turn off viewstate, show all the data summarized (using labels and literals etc) and the actual data to post could be included in the form as hidden fields. Then that form would post to the other server when the user "Confirms".

Ways to detect changed account/no account found in ASP.NET/C#

I have an ASP.NET page where at the top of the page is a search box. There are 2 text boxes - one is an autocomplete extender for the Name on a database, and one is just inputting the ID.
The page features DetailsViews and GridViews primarily, and even when no account has been searched for, these display blank data which is not ideal. I sort of fixed this by using if (IsPostBack), encasing the elements in a placeholder and setting it to visible only if the page ispostback. But this doesn't cover if the user types in an incorrect ID.
Also, some accounts have huge amounts of data inside the GridView's. I had an issue where because I have no way of detecting when a data source's rows has changed, I end up binding whenever the page loads (Page_Load method). I've come to realise this is simply very bad - there are lots of times when the user can click various things in the page and have the page postback, and it takes an eternity to load each time I click something for accounts with lots of data.
Anyway, my question is essentially two-fold but I have a feeling the solution will be similar:
1: How can I detect when there are no accounts returned when searching, and disable the Grids/Detailsviews and show an error message?
2: How can I figure out when the user searches for another account and only rebind the grids after that has happened?
Thanks
This method is very ugly but it'll get the work done.
1) To Check whether there are no records; after the AutoComplete Extenders Webservice is called if no record is returned put some value in Session like
Session["NoData"]=true;
if Records are found then;
Session["NoData"]=false;
after the webservice is called do ajax request to check that session & on the basis of value do what you want.
2) You can achieve this also by following the above option.

Email validation in C# (within the page_load)

I'm quite new to this:
I have created a simple form which contains a textbox and button and basically when the email address entered is correct, some results are shown below (this is using a gridview control).
What I am wanting to do is have some sort of email validation for the form - but have the validation placed within the page_load (within the button click) rather than the code behind the page itself.
I'm after a simple validation that checks an email has been entered otherwise display a popup and the email format is correct (abc#abc.com) in C#
I assume that the details will be displayed only when the buton is clicked ( form submitted) if so why not add a RegularExpression validator and map it to the text box. Then use the following regular expression to validate an email.
\b[A-Z0-9._%+-]+#[A-Z0-9.-]+\.[A-Z]{2,4}\b
This way it will increase user experience as well. The user does not have to wait for a post back to get the error alert.
Another regular expression for email format validation here.
This has been covered here.
Problem is there is no valid regex that covers the whole RFC 5322 grammar. All common regexes (like the one stated by Shoban) are too strict - example: the end part [A-Z]{2,4} that is supposed to cover the top level domain will tag .museum emails as invalid; but there are much more complex examples, like German Umlauts (vowel mutations) that have been allowed not too recently.
Our approach is to check for a superset rather than a subset of allowed emails in validation controls (like the one integrated integrated in Visual Studio that uses \w+([-+.']\w+)#\w+([-.]\w+).\w+([-.]\w+)* ) and deepen the check back on the server (maybe even use a webservice, like this one.
BTW, here is a better regex.

Categories

Resources