DateTimePicker vs. ObjectDataSource and Validation

[Jakub Sterba]

Greetings,

first of all I have to say that I like DateTimePicker and other calendar controls. Thus my frustration is much more deeper. I have a validator which is able to validate a date against desired date format. But with RadDateTimePicker it's useless, because date string, which is supplied to the validator is in strange only-dash-separated format (e.g. 2010-05-12-01-31-00 - I understood it is ValidationDate property). Now there is a bad security problem, when one turns his javascript off, and enters a date the format supplied to the validator will be different. When my validator expects format like 'yyyy/MM/dd' it is able to validate it when someone cheats. But when normal user enters a date and it is deformed by the DateTimePicker control, it cannot be validated against desired format 'yyyy/MM/dd'. Now it is NOT STANDARD behaviour. I expect that the control won't modify standard behaviour. It's Microsoft's job to disobey standards, please, don't do so... The controls should only sweeten one's work, but should not deform the values input by user.

I have read lots of posts on this problem, ClientEvents-OnError as the best proposed solution is not still validation and works only on client-side. Another proposion to use SelectedDate in server validation method also does not work as it is null on all invalid inputs and validator returns true. And RangeValidator, it's the same thing. Any other working solution, that everybody is still awaiting?

All solutions are welcome.

[Jakub Sterba]

Hi,

since I have no response from you yet, I have a suggestion. Many people here want to use RegularExpressionValidator or other types of validators on server-side. Is it possible to extend RadDateInput to have new property Standard (default false)? If Standard="true", then the value displayed in RadDateInput would be sent to the server, so that standard server validation would be possible (eg. not 2010-05-17-14-22-21, but according to DateFormat="MM/dd/yyyy HH:mm:ss" it would send to server 05/17/2010 14:22:21). And moreover, when invalid input is entered by user, it would be also sent to the server and it would persist even after postback, because when someone inputs 13/13/2010 14:22:21, I believe, he should be asked to correct his input, not to be pushed to fill it all again only because he made a mistake. Now the invalid input disappears after postback and what's worse, it is passed as valid on server-side. I would like to point out, that server-side validation is the only reliable validation and client-side validation should only help and speed up user's work, but in light of security it is not reliable.

Thank you for your response.

[Iana Tsolova]

Hello Jakub,

Can you specify how and when are you getting the RadDateTimePicker date to use it in your validator? It would might also help if you elaborate a bit more on your scenario and what you are trying to achieve.

Sincerely yours,
Iana
the Telerik team

[Jakub Sterba]

Hi Iana,

I have a class which inherits from System.Web.UI.WebControls.BaseValidator. There is a method called EvaluateIsValid. A standard beginning of this method is:

protected override bool EvaluateIsValid()
{
    string controlValidationValue = base.GetControlValidationValue(base.ControlToValidate);
    if (controlValidationValue.Trim().Length == 0)
    {
        return true;
    }
    ....
}

Now the problem is:

1. When you do a postback with invalid date in RadDateTimePicker's input, controlValidationValue is empty and validation method returs true. This is NOT a standard behaviour.
2. After postback, the RadDateTimePicker's input is empty and the invalid value is lost. This also is NOT a standard behaviour.
3. When there is a valid date in RadDateTimePicker's input, controlValidationValue contains only-dash-separated value (2010-05-17-14-22-21), which does NOT correspond to the desired format passed in DateInput-DateFormat attribute (but I know, that you claim, it is your desired functionality and that it's ValidationDate property of the RadDateTimePicker).

Because of these three points, validation on server (the only reliable and hacker-proof validation) is impossible. I have spent a lot of time debugging and I believe I know, how RadDateTimePicker and all calendar controls work. I still think that they don't work in a good way, because if you want to offer universal controls, the only good way, how those controls should work, is the standard way and standard behaviour.

Thank you for your response.

Yours sincerely,
    Jakub

[Iana Tsolova]

Hello Jakub,

I will try to clearify how RadDateTimePicker control works so I make sure we are on the same side.
The RadDateTimePicker input is RadDateInput. RadDateInput value can be a valid date but any other type of input. Therefore when you enter invalid date, this is not set as value of the RadDateInput. That is why the RadDateTimerPicker selected date is null on the server when you perform validation and the RaddateInput field is empty after the postback. So to make sure the RadDateTimePicker or its DateInput have valid dates for values, you only need to check if the SelectedDate property is set or not, right?

Regarding the issue, described in point 3.: I am still not sure how you were able to get the date in the preceding format and the SelectedDate property returns DateTime?. Therefore I would suggest that you send us a sample so we see what could have gone wrong on your side.

Best wishes,
Iana
the Telerik team

[Jakub Sterba]

Hi,

Well, I know how the control works. I know its possibilities. What I'm trying to tell is that it does not work in a standard way. None of the standard controls are validated through anything else but string from input. I don't say, that there is a bug or so. I say, that you could consider making an extension of RadDateInput, so that it would offer the string from its input instead of ValidationDate property. It would be the right way. Now, invalid values cannot be validated on the server, because when invalid date is entered on client side, there is and empty string on server side.

Your conclusion in the 2nd paragraph is not right. It is a "String" which is to be validated, not "DateTime?"...
Quote: "So to make sure the RadDateTimePicker or its DateInput have valid dates for values, you only need to check if the SelectedDate property is set or not, right?"

Argument:
Let's consider a non-mandatory STANDARD date input and if

1. user lets it empty, it's VALID. (controlValidationValue variable in EvaluateIsValid() method must be an empty string)
2. user fills in "ASDF", it's INVALID. (controlValidationValue variable in EvaluateIsValid() method must be "ASDF")
3. user fills in "05/14/2010", it's VALID. (controlValidationValue variable in EvaluateIsValid() method must be "05/14/2010")

After postback, the STANDARD input box is empty, contain "ASDF" or "05/14/2010" respectively, so that the user can correct his/her input.

Now let's see how RadDateInput behave if

1. user lets it empty, it is found valid - CORRECT
2. user fills in "ASDF", it is found valid - FAIL
3. user fills in "05/14/2010", it is found invalid - FAIL

After postback, the RadDateInput box is empty, empty, or contains "05/14/2010" respectively, so the input "ASDF" is lost (2nd point), or validation reports an error (3rd point). Only keeping RadDateInput empty works good, but it can't do the rest of the job.

Conclusion: RadDateInput now behave in an unexpectable way. It fails in 2 of 3 tests in use with standard server validation.

Best regards,
    Jakub

PS: I made a sample web application with standard datetime validator, but how can I attach it to my message without renaming it to .jpg, .gif or .png?

[Iana Tsolova]

Hello Jakub,

Thank you for the further details provided.
I will forward your feedback to our developers so they consider changing the RadDateInput behavior.

All the best,
Iana
the Telerik team

[Jakub Sterba]

Hi,

at least, here is the class representing standard date-time validator. I have simplified it as much as I could.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI.WebControls;
using System.Web.UI;
using System.ComponentModel;
using System.Text.RegularExpressions;
using System.Security.Permissions;

namespace RadDateInputValidationSample
{
    [ToolboxData("<{0}:DateTimeValidator runat=\"server\" ErrorMessage=\"DateTimeValidator\"></{0}:DateTimeValidator>"), AspNetHostingPermission(SecurityAction.InheritanceDemand, Level = AspNetHostingPermissionLevel.Minimal), AspNetHostingPermission(SecurityAction.LinkDemand, Level = AspNetHostingPermissionLevel.Minimal)]
    public class DateTimeValidator : BaseValidator
    {
        public string DateFormat
        {
            get
            {
                object obj2 = this.ViewState["DateFormat"];
                if (obj2 != null)
                {
                    return (string)obj2;
                }
                return String.Empty;
            }
            set
            {
                this.ViewState["DateFormat"] = value;
            }
        }

        protected override bool EvaluateIsValid()
        {
            string controlValidationValue = base.GetControlValidationValue(base.ControlToValidate);
            if (controlValidationValue.Trim().Length == 0)
            {
                return true;
            }
            DateTime dt;
            return DateTime.TryParseExact(controlValidationValue.Trim(), DateFormat, null, System.Globalization.DateTimeStyles.None, out dt);
        }
    }
}

Best regards,
    Jakub

[Iana Tsolova]

Hi Jakub,

Thank you for sharing your experience with the community. I am sure other users will find your solution useful.

Best wishes,
Iana
the Telerik team

[Jakub Sterba]

Hi,

Well, it is NOT a solution, but just a part of my code - standard validator, which does not work with your RadDateInput well. You asked me for a sample application, but I could not append it to my message, so I posted it here. This is the standard validator you can use, when trying to reproduce the behaviour I described.

Best regards,
    Jakub

[Iana Tsolova]

Hello Jakub,

In the upcoming version of the controls we will introduce InvalidTextBoxValue property for the RadDateInput control which will hold the wrong user input. I hope you can use it for your purposes.

Sincerely yours,
Iana
the Telerik team

[Jakub Sterba]

Hello,

I am affraid, this won't solve much. Until BaseValidator.GetControlValidationValue method returns real user's input (valid or invalid, it does not matter) in EvaluateIsValid method, nothing changes. It is needed to have the right value using this method, which means, that this new property (InvalidTextBoxValue) will be marked by [ValidationProperty] attribute. But I know, it would change the whole concept and it is a fatal step due to back-compatibility. But won't it worth? Your proposal is just a shortcut to another property named Text of DateInput property of RadDateTimePicker, or so, and doesn't change the behaviour. Would it be possible to change the concept so that it would correspond to the standards? I think, that the best way of doing this would be a new switch-like property (Standard="true/false") which would change the behaviour simply: ValidationDate property would return real user's input everytime, instead of preformatted text (only available in case when valid date has been input). And that's it... :)

EDIT (10/20/2010): To be more precise, it isn't problem of ValidationDate property, but of Text property of RadDateInput. This property is forced to be in that strange sortable format (yyyy-MM-dd-HH-mm-ss), which is unwelcome, if somebody is following the standards. The new property (Standard or whatever name you want - which would be false by default) should control the behaviour of this property, and either (when false) go on formatting the input just like till now, or (when set to true) keeping the input intact. Also, SelectedDate property should internally use either the sortable format represented by constant string "yyyy-MM-dd-HH-mm-ss", or the format set in DateFormat property of RadDateInput.

Best regards,
    Jakub

[Iana Tsolova]

Hi Jakub,

I unserstand you concerns however we cannot change the RadDateInput so the Text property returns the invalid value for the reasons mentioned previously. What we could do and have already done is to provide the InvalidTextBoxValue property.

Kind regards,
Iana
the Telerik team

[Jakub Sterba]

Hello,

I guess, I will have to fix it by myself and rewrite the source codes of the RadDateInput so that it would follow the standard mechanisms of ASP.NET validators.

Thank you for trying,
    Jakub

[Tangium]

Hi Jakub and anyone else having this problem,

If it's the same problem I had with invalid dates disappearing and even valid dates showing that screwy yyyy-mm-dd-hh-mm-ss format while not on the field, I eventually tracked it to this one CSS style:

input { float:left; }

There must be an easier way but adding the below to my stylesheet instantly fixed all the rad date/time picker inputs:

.riEnabled, .riDisabled, .riEmpty, .riFocused, .riHover, .riError, .riNegative
{
    float: none;
}

Not kidding -- raddateinput seems to completely blow-up if you change the input float.

Good luck!