I have a very simple form that is designed to update account expiration dates. I'm currently creating a View Model and sending that to the form, however, I still have to pass along a GUID so I know what object is being referenced on POST back.
What I'm worried about it is someone altering the guid (via JS, jQuery, etc..) to match an entity that they're not authorized for. After the form is posted, I'm checking to see if the user making the request matches the username of the entity that maps from the ViewModel (I realize at some point administrators and future permissions will need to be added, I'm keeping it simple for design-pattern sake).
Is this the proper way to do this, or is there a more efficient out of the box approach?
Entity:
public class FtpTrack
{
[Key]
public int id { get; set; }
public string domainUserName { get; set; }
public string ftpAccountName { get; set; }
public DateTime expirationDate { get; set; }
}
ViewModel
public class FtpTrackViewModel
{
public int guid { get; set; }
public DateTime expirationDate { get; set; }
}
Controller
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Edit(FtpTrackViewModel ftptrackVM)
{
if (ModelState.IsValid)
{
FtpTrack ftptrack = db.FtpTracks.Find(ftptrackVM.guid);
if (ftptrack.domainUserName == User.Identity.Name.Split('\\')[1])
{
ftptrack.expirationDate = ftptrackVM.expirationDate;
db.Entry(ftptrack).State = EntityState.Modified;
db.SaveChanges();
return RedirectToAction("Index");
}
}
return View(ftptrackVM);
}
AllowAnonymous
attribute nor theAuthorize
attribute. \$\endgroup\$ – Bjørn-Roger Kringsjå Jul 11 '15 at 8:38