Can't set Skin property in Medium Trust

[bdukes]

I just switched my website over to Medium Trust to check if there were any issues, and I got a pretty nasty exception which I traced to my setting the Skin property on some RadChart instances.  The partial stack trace follows:

Telerik.Charting.Styles.SkinnablePropertyAttribute..ctor() ---> System.MethodAccessException: Telerik.Charting.Styles.SkinnablePropertyAttribute..ctor() ---> System.Security.SecurityException: Request failed. at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Assembly asm, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed) at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Object assemblyOrString, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed) at System.Security.CodeAccessSecurityEngine.CheckSetHelper(PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Object assemblyOrString, SecurityAction action, Boolean throwException) at System.Security.PermissionSetTriple.CheckSetDemand(PermissionSet demandSet, PermissionSet& alteredDemandset, RuntimeMethodHandle rmh) at System.Security.PermissionListSet.CheckSetDemand(PermissionSet pset, RuntimeMethodHandle rmh) at System.Security.PermissionListSet.DemandFlagsOrGrantSet(Int32 flags, PermissionSet grantSet) at System.Threading.CompressedStack.DemandFlagsOrGrantSet(Int32 flags, PermissionSet grantSet) at System.Security.CodeAccessSecurityEngine.ReflectionTargetDemandHelper(Int32 permission, PermissionSet targetGrant, CompressedStack securityContext) at System.Security.CodeAccessSecurityEngine.ReflectionTargetDemandHelper(Int32 permission, PermissionSet targetGrant) The action that failed was: Demand The type of the first permission that failed was: System.Security.PermissionSet --- End of inner exception stack trace --- at System.Reflection.MethodBase.PerformSecurityCheck(Object obj, RuntimeMethodHandle method, IntPtr parent, UInt32 invocationFlags) at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.ComponentModel.AttributeCollection.GetDefaultAttribute(Type attributeType) at System.ComponentModel.AttributeCollection.get_Item(Type attributeType) at Telerik.Charting.Styles.StyleSerializer.Deserialize(XmlElement rootElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.DeserializeProperty(PropertyDescriptor propDescriptor, XmlElement propElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.Deserialize(XmlElement rootElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.DeserializeProperty(PropertyDescriptor propDescriptor, XmlElement propElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.Deserialize(XmlElement rootElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.DeserializeProperty(PropertyDescriptor propDescriptor, XmlElement propElement, Object styleContainer) at Telerik.Charting.Styles.StyleSerializer.Deserialize(XmlElement rootElement, Object styleContainer) at Telerik.Charting.Chart.LoadSkin(Object skinContainer, TextWriter text) at Telerik.Charting.Chart.ApplySkin(String skinName) at Telerik.Charting.Chart.set_Skin(String value)

If I removed the Skin="Telerik" from the markup, it works fine.  If I run the site in Full Trust, it works fine.  Is this a known issue, are there any workarounds or fixes?

Thanks,

[Giuseppe]

Hi bdukes,

We are unable to reproduce the problematic behavior with the latest version of the control (Q2 2008). We have attached a sample application to demonstrate our observations -- please review it and let us know if we are missing something out.


Greetings,
Manuel
the Telerik team

Check out Telerik Trainer, the state of the art learning tool for Telerik products.

[bdukes]

I unzipped your application and set it up in IIS.  It is still giving me the same exception on three different machines (screenshots for localhost and for IIS 6.0 with customErrors="Off" are at http://teleriktest.engagetest.com/teleriktest 20080805-2.png and http://teleriktest.engagetest.com/teleriktest 20080805.png, respectively).  Again, if I remove Skin="Telerik" or comment out the trust level node of the web.config, it works correctly.

Let me know if there's anything else you want me to try.

[Giuseppe]

Hello bdukes,

Indeed on further investigation our developers were able to reproduce the problematic behavior you are experiencing on your end (it seems there are two almost identical sets of medium trust settings under C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG that differ in the fact that ReflectionPermission is granted only for one of them thus we were unable to reproduce the problem earlier).

We have attached an unofficial custom build that should behave as expected now. We have also updated your Telerik points for the report.


Sincerely yours,
Manuel
the Telerik team

Check out Telerik Trainer, the state of the art learning tool for Telerik products.

[bdukes]

Thanks for the help.  I'll give this a test drive to make sure that it works for us.  Should I be expecting this fix to be included in next month's official update?

[Giuseppe]

Hi bdukes,

The fix will be part of the official service pack release scheduled for the end of August.

Hope this helps.


All the best,
Manuel
the Telerik team

Check out Telerik Trainer, the state of the art learning tool for Telerik products.

[bdukes]

Just to finish out the thread, that fix works for us.  Thanks a lot.