CODEWITHSUNDEEP
asp.net-mvcentity-framework
dennis
dennis

Reputation:

javascript injection asp mvc

i have created the controller :

    [Authorize]
    [AcceptVerbs(HttpVerbs.Delete)]
    public ActionResult Delete(int id)
    {
        try
        {
            db.DeleteObject(db.AEROLINEA.FirstOrDefault(x => x.AEROLINEAID == id));
            db.SaveChanges();
        }
        catch { /* TODO:Display message*/ }

        return View();
    }

if i execute in firebug the next javascript anyone logged could delete an airline even if he doesnt have permissions to delete 

    var action = "/Airline/Delete/" + recordId;

    var request = new Sys.Net.WebRequest();
    request.set_httpVerb("DELETE");
    request.set_url(action);
    request.add_completed(deleteCompleted);
    request.invoke();

HOw can avoid this issue???

Upvotes: 1

Views: 244

Answers (3)

eu-ge-ne
eu-ge-ne

Reputation: 28153

[Authorize] without parameters allows you to indicate that a user must be logged in. You also can specify users/roles, authorized to access your action

Upvotes: 0

Erik
Erik

Reputation: 870

Or use the AntiforgeryToken with a juicy salt at the View..

Upvotes: 0

user434917
user434917

Reputation:

You can filter the the roles:

Example: 

[Authorize(Roles="Admin")]
    [AcceptVerbs(HttpVerbs.Delete)]
    public ActionResult Delete(int id)
    {
        try
        {
            db.DeleteObject(db.AEROLINEA.FirstOrDefault(x => x.AEROLINEAID == id));
            db.SaveChanges();
        }
        catch { /* TODO:Display message*/ }

        return View();
    }

Upvotes: 2

Related Questions