cyphersec A blog about Web Application Security and .NET development best practices

5May/080

ASP.NET MasterPage object tricks

Dynamic Path Hack

Applying and fixing up the non ASP.NET controls path is quite easy when dealing with Masterpages. The only thing you need to remember is that asp,net will set the right property only if you are running .net controls.

That's could be a problem when dealing with rebrands or when migrating a previous version of a large website. In order to fix this problem you can add the runat="server" string using the Find&Replace Visual Studio's feature with help of regular expressions.

<img src="image.jpg" /> becomes <img src="image.jpg" runat="server" />

This works because ASP.NET uses this information to create an HtmlImage server control. This object is created after the Page object for the master page is instantiated. At this point, ASP.NET interprets all the paths relative to the location of the master page. You could use the same technique to fix <a> tags that provide relative links to other pages.

MasterPages - ContentPages informations Flow

Sometimes you'll be asked to let information go through between ContentPages and MasterPages. In order to do this you can create a controll on the MasterPage and write down some code as a MasterPage property.  For example it's possible to create a label controll and set his text through the ContentPage.

 

public string BannerText
{
get { return lblTitleContent.Text; }
set { lblTitleContent.Text = value; }
}

The content page can now change the text. The only caveat is that the Master property returns an object that’s typed as the generic MasterPage class. You need to cast it to your specific master page class to get access to any custom members you’ve added. The fastest way to have a strongly typed access to the masterpage is to add the MasterPage directive to the contentPage. All you need to do that is indicate the virutal path of the corresponding .master file. Like this

 

<%@ MasterType VirtualPath="~/SiteTemplate.master" %>

and than you can use a simpler strongly taped code when access the master page.

 

protected void Page_Load(object sender, EventArgs e)
{
Master.BannerText = "Content Page #1";
}

Brute Force the MasterPage Object

You can also get access to an individual control on a master page through brute force. The trick is to use the MasterPage.FindControl() method to search for the object you want based on its unique name. When you have the control, you can then modify it directly. Here’s an example that uses this technique to look for a label:

Label lbl = Master.FindControl("lblTitleContent") as Label;
if (lbl != null)
{
lbl.Text = "Content Page #1";
}

Of course, this type of interaction breaks all the rules of proper class-based design and encapsulation.
If you really need to access a control in a master page, you are far better off wrapping it by adding properties to your master page class. That way, the interaction between the content page and the master page is clear, documented, and loosely coupled. If your content page tinkers directly with the internals of another page, it’s likely to lead to fragile code models with dependencies that break when you edit the master page.cs.

Dynamically Setting a Master Page

Changing the master page programmatically is easy. All you need to do is set the Page.MasterPageFile property. The trick is that this step needs to be completed in the Page.Init event stage. After this point, attempting to set this property causes an exception.
You can implement this technique in much the same way that you implemented dynamic themes earlier in this chapter. However, this technique has a potential danger—a content page isn’t necessarily compatible with an arbitrary master page. If your content page includes a Content tag that doesn’t correspond to a ContentPlaceHolder in the master, an error will occur. To prevent this problem, you need to ensure that all the master pages you set dynamically include the same placeholders.

About Alessio Marziali

Alessio Marziali (MCTS) is a Security Consultant with 10 years of experience developing secure applications with Microsoft .NET in a variety of sectors in UK and Italy. Published technical author with two ASP.NET books currently available for purchase and OWASP Code Crawler Project Leader.
Filed under: .NET Leave a comment
Comments (0) Trackbacks (0)

No comments yet.


Leave a comment


No trackbacks yet.