SecuredPropertySetter Class

An axillary class that allows you to specify an XPO persistent object’s properties bypassing security checks.

Namespace : DevExpress.ExpressApp.Xpo

Assembly : DevExpress.ExpressApp.Xpo.v25.2.dll

NuGet Package : DevExpress.ExpressApp.Xpo

Declaration

C#
VB.NET

csharp

public static class SecuredPropertySetter

Public Module SecuredPropertySetter

Remarks

Use the SecuredPropertySetter class’s SetPropertyValueWithSecurityBypass static method allows you to modify the value of a business object’s property even if write access to this property is denied for the current user by the XAF Security System. If your business object class extends BaseObject and you need to modify this object’s own property, you can use the BaseObject.SetPropertyValueWithSecurityBypass protected method instead.

In applications with middle-tier security, you can call this method only from a business object’s IXafEntityObject.OnSaving method, otherwise an exception is thrown.

Note

In applications with middle-tier security, an object’s OnSaving method is only called on the middle-tier server side. From this method, you can call SetPropertyValueWithSecurityBypass to set values of business object properties even if the client application has no access rights for these properties. Thus, you can use this method to securely initialize properties with sensitive data (it is also important that you define access rules to additionally restrict access to these properties for application users).

The following code snippet demonstrates how to use this method to initialize CreatedBy, UpdatedBy, and UpdatedOn properties of a business class.

csharp

using DevExpress.ExpressApp.Security;
using DevExpress.Persistent.BaseImpl.PermissionPolicy;
using DevExpress.Xpo;
using System.ComponentModel;
// ...
public class TestClass : XPLiteObject {
    public TestClass(Session session) : base(session) { }
    // ...
    ApplicationUser _createdBy;
    ApplicationUser _updatedBy;
    DateTime? _updatedOn;

    [ModelDefault(nameof(IModelCommonMemberViewItem.AllowEdit), "False")]
    public ApplicationUser CreatedBy {
        get { return _createdBy; }
        set { 
            SetPropertyValue("CreatedBy", ref _createdBy, value);
        }
    }

    [ModelDefault(nameof(IModelCommonMemberViewItem.AllowEdit), "False")]
    public ApplicationUser UpdatedBy {
        get { return _updatedBy; }
        set {
            SetPropertyValue("UpdatedBy", ref _updatedBy, value);
        }
    }

    [ModelDefault(nameof(IModelCommonMemberViewItem.AllowEdit), "False")]
    [ModelDefault(nameof(IModelCommonMemberViewItem.DisplayFormat), "G")]
    public DateTime? UpdatedOn {
        get { return _updatedOn; }
        set {
            SetPropertyValue("UpdatedOn", ref _updatedOn, value);
        }
    }

    protected override void OnSaving() {
        base.OnSaving();
        if (Session.IsNewObject(this)) {
            SecuredPropertySetter.SetPropertyValueWithSecurityBypass(this, nameof(CreatedBy), GetCurrentUser());
        }
        else {
            SecuredPropertySetter.SetPropertyValueWithSecurityBypass(this, nameof(UpdatedOn), DateTime.Now);
            SecuredPropertySetter.SetPropertyValueWithSecurityBypass(this, nameof(UpdatedBy), GetCurrentUser());
        }
    }

    ApplicationUser GetCurrentUser() { 
        return Session.GetObjectByKey<ApplicationUser>(
            Session.ServiceProvider.GetRequiredService<ISecurityStrategyBase>().UserId);
    }
    // ...
}

Inheritance

Object SecuredPropertySetter