[Solved] Securing RadMultiPage PageViews

[Chad]

I have a RadMultiPage with several pageviews, each of which is tied to a specific tab in a RadTabStrip. When the page loads I programmatically determine which tabs are accessible, and hide the rest. I then iterate over the pageviews in the associated RadMultiPage to mark them visible if the tab is also visible. Once that's done I check if there are any visible tabs, and if there are I set the selectedindex of both the tabstrip and the multipage to 0.

The tabs are showing/hiding correctly, but the multipage pageviews are not. If the first tab/pageview is not visible the tab is gone, but the pageview still shows. If I set all of the pageviews to visible=false but leave the tabs visible I can click through all the tabs and their pageviews load which is not what I expect.

If a control is set to "Visible=false" I would expect it to be completely removed from the server side and have no possibility to render. Why is this not happening? Here's some of the relevant code:

<telerik:RadTabStrip ID="tabs" runat="server" MultiPageID="pages" AutoPostBack="true" ShowBaseLine="true" Align="Right">
<Tabs>
<telerik:RadTab Text="Tab1" PageViewID="Page1" Value="Tab1" Visible="false" />
<telerik:RadTab Text="Tab2" PageViewID="Page2" Value="Tab2" Visible="false" />
</Tabs>
</telerik:RadTabStrip>

<telerik:RadMultiPage ID="pages" runat="server" RenderSelectedPageOnly="true">
<telerik:RadPageView ID="Page1" runat="server">
...

tabs.FindTabByValue("Tab1").Visible = HasPermission("Tab1");
tabs.FindTabByValue("Tab2").Visible = HasPermission("Tab2");
...

foreach (RadTab tab in tabs.Tabs)
{
pages.FindPageViewByID(tab.PageViewID).Visible = tab.Visible;
}

if (tabs.Tabs.Count(x => x.Visible) > 0)
{
tabs.SelectedIndex = 0;
pages.SelectedIndex = 0;
}

 

[Chad]

I believe I solved this by replacing the "SelectedIndex = 0" code section in my previous post with the following (using the same loop from the previous code)...

bool isSelectionSet = false;
foreach (RadTab tab in tabs.Tabs)
{
    pages.FindPageViewByID(tab.PageViewID).Visible = tab.Visible;

    if (tab.Visible && !isSelectionSet)
    {
        tab.Selected = true;
        pages.FindPageViewByID(tab.PageViewID).Selected = true;
        isSelectionSet = true;
    }
}

I'm still wondering if this means the pageviews are "secure" on the server or if there's some client side "hacky" way of requesting the individual page views and the server responding with the content. Can someone confirm that this is a viable approach to securing pageviews inside of a radmultipage?