Develop Reference

is there a way to somehow block certain pages (aspx) based on a condition MVC?

I have a customized authentication on the system, what I would like is for certain pages (ex. EditingProfile.aspx) to not be accessible through URL navigation.
if a user is authorized: buttons (ex. btnEditingProfile) is enabled and would redirect to EditingProfile.aspx.
is a user isn't authorized: buttons (btnEditingProfile) would be disable. I'm looking for a way to prevent users from accessing EditingProfile.aspx through URL navigation.
The system I'm working on is old so I need a safe way to secure it that wouldn't interfere with other aspects of the system.
MainMenu.aspx
protected void Page_Load(object sender, EventArgs e)
{
//CODE
if (!m_mainController.m_IsAutorized)
btnEditProfile.Enabled = false;
//MORE CODE
}
protected void btnEditProfile_Click(object sender, EventArgs e)
{
queryStrings=SOMEVALUE();
string QueryString = QueryStringEncrypter.GetEncryptedQueryString(queryStrings);
Response.Redirect("ProfileDetails.aspx?" + QueryString, false);
}

In my opinion, each user should has an login session to know their permission.
https://www.codeproject.com/Articles/21474/Easy-way-to-create-secure-ASP-NET-login-using-Sess

Following Tim Nguyen's suggestion I did the following:
in MainMenue.aspx I added
protected void Page_Load(object sender, EventArgs e)
{
//code
if (!m_mainController.m_IsAutorized)
btnEditProfile.Enabled = false;
Session["url"] = Request.UrlReferrer.AbsoluteUri.ToString();
//more code
}
in EditingProfile.aspx:
protected void Page_Load(object sender, EventArgs e)
{
if (Session["url"] != null)
{
Response.Redirect(Session["url"].ToString());
}
//code
}
nothing else was changed. The code is running the way I want it to so I thought id update this question in case someone need it.

How to disable every navigation in WebBrowser?

I have a WebBrowser control which I dinamically refresh/change url based on user input. I don't want to let the user to navigate, so I set AllowNavigation to false. This seems to be OK, however the below link is still "active":
Close Page
The issue here is: If the user clicks it, and confirms closure in the pop-up window I can't manage WebBrowser anymore. Looks like it is closed though the last page is still visible. Also I can't remove this link as the site is not managed by me.
Disable the control? Nope, I have to allow the user to highlight and copy text from the webpage.
Do I have any other option to disable literally ALL links?
#TaW: here is my code based on yours. So I have to set the url from my code and call a custom one:
button_click()
{
webBrowser1_load_URL("http://website/somecheck.php?compname=" + textBoxHost.Text);
}
Here it is the function:
private void webBrowser1_load_URL(string url)
{
string s = GetDocumentText(url.ToString());
s = s.Replace(#"javascript:window.close()", "");
webBrowser1.AllowNavigation = true;
webBrowser1.DocumentText = s;
}
The rest is exaclty what's in your answer:
private void webBrowser1_DocumentCompleted(object sender,
WebBrowserDocumentCompletedEventArgs e)
{
webBrowser1.AllowNavigation = false;
}
public string GetDocumentText(string s)
{
WebBrowser dummy = new WebBrowser(); //(*)
dummy.Url = new Uri(s);
return dummy.DocumentText;
}
Still it's not working. Please help me to spot the issue with my code.

If you have control over the loading of the pages you could grab the pages' text and change the code to disable rogue scripts. The one you showed can simply be deleted. Of course you might have to forsee more than the one..
Obviously this could be eased if you could do without javascript alltogether, but if that is not an option go for those that do real or pseudo-navigation..
private void webBrowser1_DocumentCompleted(object sender, WebBrowserDocumentCompletedEventArgs e)
{
webBrowser1.AllowNavigation = false;
}
private void loadURL_Click(object sender, EventArgs e)
{
webBrowser1.AllowNavigation = true;
string s = File.ReadAllText(textBox_URL.Text);
s = s.Replace("javascript:window.close()", "");
webBrowser1.DocumentText = s;
}
If the pages are not in the file system, the same trick should work, for instance by loading the URL into a dummy WebBrowser like this:
private void cb_loadURL_Click(object sender, EventArgs e)
{
string s = GetDocumentText(tb_URL.Text);
s = s.Replace("javascript:window.close()", "");
webBrowser1.AllowNavigation = true;
webBrowser1.DocumentText = s;
}
public string GetDocumentText(string s)
{
WebBrowser dummy = new WebBrowser(); //(*)
dummy.Url = new Uri(s);
return dummy.DocumentText;
}
Note: According to this post you can't set the DocumentText quite as freely as one would think; probably a bug.. Instead of creating the dummy each time you can also move the (*) line to class level. Then, no matter how many changes you had to make, you would always have an unchanged version, th user could e.g. save somewhere..

ASP.NET get count of logged-In User

I would like to display number logged-In users count in my page. I implemented this using Application Variable, but the problem is its not decreasing the count when user close the browser.
First i opened the web application using IE the count became 1, then i opened the app using firefox the count became 2. When i close any one of the browser the count not getting decrease.
void Application_Start(object sender, EventArgs e)
{
Application["UsersCount"] = 0;
}
void Application_End(object sender, EventArgs e)
{
}
void Session_Start(object sender, EventArgs e)
{
if (Application["UsersCount"] != null)
{
Application.Lock();
Application["UsersCount"] = ((int)Application["UsersCount"]) + 1;
Application.UnLock();
}
}
void Session_End(object sender, EventArgs e)
{
Application.Lock();
Application["UsersCount"] = ((int)Application["UsersCount"]) - 1;
Application.UnLock();
}
Any other way to achieve this?
Thank you.!

This is not so simple to implement. To be logged in doesn`t actually necessary mean that user doing something. You should set some timeout (probably the same as auth cookie life-time) and check the last activity mark of each user. Special DB table is good for that, but if you want quick and dirty solution:
You can keep IDictionary<Guid, DateTime> which you will update on each request. Guid is for UserID, DateTime for the last activity. On each request (probably somewhere in MasterPage code behind) you update this dictionary with current DateTime. Then you can check count of IDs with DateTime less than timeout.
IDictionary<Guid, DateTime> userActivityLog = Application["UserActivityLog"] as IDictionary<Guid, DateTime>;
DateTime timeout = DateTime.Now.AddHours(-1); // one hour timeout
int loggedCount = userActivityLog.Count(x => x.Value > timeout);

how to avoid re initialization of session value after redirecting to same page

I have intialized some session variables in page load method to zero. Then I am modifying them in button press method. I am using one session variable as a counter but when I am redirecting the page to the same page, the variables are intialized again. Please help me to prevent this re-initialization. I don't want to use static variables.
The scenario is-
protected void Page_Load(object sender, EventArgs e)
{
session["counter"] = 0;
}
protected void Button1_Click(object sender, EventArgs e)
{
int count = (int)session["counter"];
count++;
session["counter"] = count;
response.redirect("same page");
}

Assuming you just want to check for a non set session variable and if so, set it to zero, then you could just do:
protected void Page_Load(object sender, EventArgs e)
{
if(session["counter"] == null) {
session["counter"] = 0;
}
}
There are also a range of client side options you could use, depending on the situation.

Use
protected void Page_Load(object sender, EventArgs e)
{
if(!IsPostBack)
session["counter"]=0;
}
protected void Button1_Click(object sender, EventArgs e)
{
int count=(int)session["counter"];
count++;
session["counter"]=count;
//remove response.redirect("same page");
}
Your buuton is server side so your page will postback so you do not need to use response.redirect("same page");

If you are indeed redirecting, and not posting back, just check, on page load, if your initial variable has been set? If not, set it. If it is set, ignore setting it.
'set initial value
if session("counter") is nothing then
session("counter") = 0
end if
If you are posting back, you could also use the above, or you could:
If not isPostBack then
session("counter") = 0
end if

You can move that initialisation to a different page. Instead of directly jumping to your "same page" from another part of your application, julp to an "initializer" instead. That page initializes your session variables and immediately redirects to your "same page".
Your "Button_Click" still redirects to "same page", bypassing that initialisation.

ASP.NET C# - How to retain value after Response.Redirect

I'm working in ASP.NET c# application.
I came to a part where I need to retain some value after response.redirect to the same page without using additional QueryString or Session, because Session more or less may burden the server's performance even just a small value.
Below is my code fragment:
protected void ddl_SelectedIndexChanged(object sender, EventArgs e)
{
string id = ddl.SelectedValue;
string id2 = ddl2.SelectedValue;
Response.Redirect("http://sharepoint2007/sites/home/Lists/CustomList/DispForm.aspx?ID=" + id);
}
I wanted to retain the value id2 after the Response.Redirect, I've tried ViewState but seem like after the redirect, it treat the page as new page and ViewState value gone.
Update:
My intention to retain the value after redirect is wanted to bind back the dropdownlist selected value.
Please help.
Thank you in advanced.

using cookies will do the trick:
protected void ddl_SelectedIndexChanged(object sender, EventArgs e)
{
string id = ddl.SelectedValue;
string id2 = ddl2.SelectedValue;
HttpCookie cookie = new HttpCookie("SecondId", id2);
Response.Cookies.Add(cookie);
Response.Redirect("http://sharepoint2007/sites/home/Lists/CustomList/DispForm.aspx?ID=" + id);
}
protected void OnLoad(object sender, EventArgs e)
{
string id2 = Request.Cookies["SecondId"];
//send a cookie with an expiration date in the past so the browser deletes the other one
//you don't want the cookie appearing multiple times on your server
HttpCookie clearCookie = new HttpCookie("SecondId", null);
clearCookie.Expires = DateTime.Now.AddDays(-1);
Response.Cookies.Add(clearCookie);
}

Make use of Session variable will do for you
Code for you
Session["id2"] = ddl2.SelectedValue;
as you are redirecting from one page to another page viewstate is not going to help you , Session varialbe can able to store value till the user logout of site or till session ends, ViewState is helpfull when you are doing autopostback to your page
or
if possible you can attach id2 variable in querystring only as you are doing with id1 variable

besides session, query string, you can also use cookie, application variable and database to persist your data.

You can achieve it using Session or by QueryString
By Session
In your first page:
Session["abc"] = ddlitem;
Then in your next page access the session using:
protected void Page_Load(object sender, EventArgs e)
{
String cart= String.Empty;
if(!String.IsNullOrEmpty(Session["abc"].ToString()))
{
xyz= Session["abc"].ToString();
// do Something();
}
else
{
// do Something();
}
}
-
By QueryString
In your first page:
private void button1_Click(object sender, EventArgs e)
{
String abc= "ddlitem";
Response.Redirect("Checkout.aspx?ddlitemonnextpage" + abc)
}
In your second page:
protected void Page_Load(object sender, EventArgs e)
{
string xyz= Request.QueryString["ddlitemonnextpage"].ToString();
// do Something();
}