This page presents a security problem.
Not yet identified the cause of the error. This page was listing all the files in a folder, it worked perfectly. Now she is listing these same files, but using ajax.
The code is simple: I have a PartialView, which is a WebGrid that lists the files in this folder:
PartialView "_files.cshtml"
@model string[]
@{
var folderName = Request["FolderName"];
var columns = new List<WebGridColumn>
{
{ ... }
};
if (Request.IsAuthenticated)
{
columns.Add( { ... } );
}
var grid = new WebGrid(
source: Model,
ajaxUpdateContainerId: folderName + "-grid",
rowsPerPage: 10);
}
@grid.GetHtml(columns: columns,
headerStyle: "grid-header"
)
这项请求由这一支流带提出:
Index.cshtml>
<script type="text/javascript">
$(window).load(function () {
loadFiles("Documentos");
});
function loadFiles(folderName) {
$.ajax(
{ type: "GET",
url: /Downloads/Files?folderName= + folderName,
success: function (data) {
$("#" + folderName + "-grid").html(data);
}
})
}
</script>
<div id="Documentos-grid"></div>
www.un.org/Depts/DGACM/index_spanish.htm 在主计长中,我请部分意见:。
public string[] GetFiles(string folderName)
{
var locations = Server.MapPath("~/App_Data/Downloads/");
return Directory.GetFiles(Path.Combine(locations, folderName));
}
public ActionResult Files(string folderName)
{
return PartialView("_files", GetFiles(folderName));
}
www.un.org/Depts/DGACM/index_spanish.htm 这些档案被送至文件夹:
/App_Data/Downloads/
www.un.org/Depts/DGACM/index_spanish.htm Web.Config
<?xml version="1.0"?>
<configuration>
<location allowOverride="true">
<system.web>
<securityPolicy>
<trustLevel name="Full" policyFile="internal" />
<trustLevel name="High" policyFile="web_hightrust.config" />
<trustLevel name="Medium" policyFile="web_mediumtrust.config" />
<trustLevel name="Low" policyFile="web_lowtrust.config" />
<trustLevel name="Minimal" policyFile="web_minimaltrust.config" />
</securityPolicy>
<trust level="Medium" originUrl="" />
</system.web>
</location>
</configuration>
<><><><><>><>>>><>>>>>>
www.un.org/Depts/DGACM/index_spanish.htm 错误发生在方法第3行:GetBoletins。
private DataContext db = new DataContext();
public IList<Boletim> GetBoletins()
{
return (from boletim in db.BoletinsSemanais
where boletim.Year == DateTime.Now.Year
orderby boletim.Year, boletim.Week, boletim.Name
select boletim).Take(5).ToList();
}
<>Another Assembly
www.un.org/Depts/DGACM/index_spanish.htm 数据目录是另一组。
public class DataContext : DbContext
{
public DbSet<Boletim> BoletinsSemanais { get; set; }
public DataContext()
: base("name=DefaultConnection")
{
}
protected override void OnModelCreating(ModelBuilder modelBuilder)
{
modelBuilder.Conventions.Remove<PluralizingTableNameConvention>();
base.OnModelCreating(modelBuilder);
}
}