RadSessionPageStateCompression and RadListView edit

[Flappie]

Hello,

I turned on Compression using the following in a browser file:

<browsers>
    <browser refID="Default">
        <controlAdapters>
            <adapter controlType="System.Web.UI.Page"
                     adapterType="Telerik.Web.UI.RadSessionPageStateCompression" />
        </controlAdapters>
    </browser>
</browsers>

That mostly works fine. However, when I create a page with a RadListView with an EditItemTemplate it throws a security exception. Since it works locally, but not on a shared host I'm assuming this is a medium trust issue.

The code is as follows:

<telerik:RadScriptManager ID="MainRadScriptManager" runat="server" EnableCdn="true">
</telerik:RadScriptManager>
<telerik:RadListView ID="TestRadListView" runat="server"
    DataKeyNames="TestID" DataSourceID="TestLinqDataSource">
    <LayoutTemplate>
        <asp:PlaceHolder ID="itemPlaceholder" runat="server"></asp:PlaceHolder>
    </LayoutTemplate>
    <ItemTemplate>
        <p><%# Eval("Name") %></p>
    </ItemTemplate>
    <EditItemTemplate></EditItemTemplate>
</telerik:RadListView>

<asp:LinqDataSource ID="TestLinqDataSource" runat="server"
    ContextTypeName="TestDataContext" TableName="Tests">
</asp:LinqDataSource>

If I remove the EditItemTemplate, it works again. The above is just a simple way to get the error to reproduce, the actual page is more complicated.


So, a few questions:
Is there something I forgot to do on the page itself?
If not, is there a way to make this work under medium trust?

If not, what is another simple method of moving the viewstate off the page with the above working?

Thanks

[Tsvetina]

Hi,

Could you please confirm if the same happens when you save your ViewState in a hidden field instead of the Session:

<browsers>
 <browser refID="Default">
   <controlAdapters>
     <adapter controlType="System.Web.UI.Page" adapterType="Telerik.Web.UI.RadHiddenFieldPageStateCompression" />
   </controlAdapters>
 </browser>
</browsers>

Greetings,
Tsvetina
the Telerik team

[Flappie]

Hello,

Thank you for replying.

Yes, the same happens. It works under full trust, but when I upload it to shared hosting, or put <trust level="Medium"/> in the web.config file, it throws the following exception:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stacktrace:

[SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.]
   System.Security.CodeAccessSecurityEngine.SpecialDemand(PermissionType whatPermission, StackCrawlMark& stackMark) +0
   System.Security.CodeAccessPermission.Demand(PermissionType permissionType) +28
   System.Runtime.Serialization.Formatters.Binary.ObjectWriter.Serialize(Object graph, Header[] inHeaders, __BinaryWriter serWriter, Boolean fCheck) +78
   System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph, Header[] headers, Boolean fCheck) +133
   System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Serialize(Stream serializationStream, Object graph) +13
   System.Web.UI.ObjectStateFormatter.SerializeValue(SerializerBinaryWriter writer, Object value) +2937

Thanks

[Tsvetina]

Hello,

I researched this scenario further and the reason it does not work in medium trust is that the compression uses BinaryFormatter for binary serialization and binary serialization requires full trust. So, only in full trust you can take advantage of our viewstate compression.

Kind regards,
Tsvetina
the Telerik team