This is a migrated thread and some comments may be shown as answers.

The Menu control and AuthorizeCore

4 Answers 112 Views

General Discussions

This is a migrated thread and some comments may be shown as answers.

This question is locked. New answers and comments are not allowed.

ben asked on 07 Oct 2010, 01:54 PM

test-projects.zip

Hi All,

I'm using the Menu control that's tied to the site map in my project and I'm extending AuthorizeAttribute so I can customize the access based on the logged on user. The class is called CustomAuthorizeAttribute which derives from AuthorizeAttribute and overrides AuthorizeCore, which put the custom security stuff in. Then I use CustomAuthorizeAttribute to decorate each controller's action that corresponds to a menu item.

From my understanding, when the Menu control is building up the menu items, it will notice the presence of CustomAuthorizeAttribute and end up calling AuthorizeCore to determine if each menu item should be visible to the user. This setup was working well for MVC2 but after I upgraded to MVC3 Preview (MVC3 Beta also has the same issue), the menu items won't show up anymore. I even hardcoded the AuthorizeCore to always return "true" but that didn't help.

To look into the issue further, I have set up two test projects (attached) - one using MVC2 and another using MVC3 Preview. CustomAuthorizeAttribute.cs contains the definition of CustomAuthorizeAttribute. And I have the attribute declared on the Index action of TestController. It turns out that for the MVC3 project, AuthorizeCore is not getting called at all. It seems like when I put CustomAuthorizeAttribute on top of TestController.Index() the menu item corresponding to it will just be hidden. Any thoughts on this will be appreciated.

Thanks a lot,
Ben

4 Answers, 1 is accepted

Accepted

answered on 11 Oct 2010, 04:00 PM

Hello Ben,

The reported issue is related with .NET 4.0. Creating of the custom authorize attribute fails in .NET 4.0.
We were able to fix this problem and the fix will be included in the next official release of the Telerik components for ASP.NET MVC.

Currently you can avoid this behavior with overriding WriteProperty placed in AuthorizeAttributeBuilder class. This class is in Telerik.Web.Mvc\Infrastructure\Implementation folder. Here is the modified method:

[WriteProperty]:

private static void WriteProperty(Type parentType, TypeBuilder builder, string name, Type type)

{

const BindingFlags BindingFlag = BindingFlags.Public | BindingFlags.Instance;

const MethodAttributes MethodAttribute = MethodAttributes.Public | MethodAttributes.Virtual | MethodAttributes.NewSlot;

string getName = "get_" + name;

string setName = "set_" + name;

MethodInfo parentGetMethod = parentType.GetMethod(getName, BindingFlag);

MethodBuilder implementedGetMethod = builder.DefineMethod(getName, MethodAttribute, type, Type.EmptyTypes);

ILGenerator getIl = implementedGetMethod.GetILGenerator();

getIl.Emit(OpCodes.Ldarg_0);

getIl.Emit(OpCodes.Call, parentGetMethod);

getIl.Emit(OpCodes.Ret);

MethodInfo interfaceGetMethod = authorizeAttributeType.GetMethod(getName, BindingFlag);

builder.DefineMethodOverride(implementedGetMethod, interfaceGetMethod);

MethodInfo parentSetMethod = parentType.GetMethod(setName, BindingFlag);

MethodBuilder implementedSetMethod = builder.DefineMethod(setName, MethodAttribute, typeof(void), new[] { type });

ILGenerator setIl = implementedSetMethod.GetILGenerator();

setIl.Emit(OpCodes.Ldarg_0);

setIl.Emit(OpCodes.Ldarg_1);

setIl.Emit(OpCodes.Call, parentSetMethod);

setIl.Emit(OpCodes.Ret);

MethodInfo interfaceSetMethod = authorizeAttributeType.GetMethod(setName, BindingFlag);

builder.DefineMethodOverride(implementedSetMethod, interfaceSetMethod);

}

The bold text is the applied fix.

Regards,
Georgi Krustev
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items