Home/ Questions/Q 1066971
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-16T20:05:28+00:00

I have a usercontrol which is responsible for presenting creation and change of users.

  • 0

I have a usercontrol which is responsible for presenting creation and change of users.
The usercontrol is bound to an entity delivered by a RIA Service:

[MetadataType(typeof(User.UserMetadata))]
public partial class User
{
    internal class UserMetadata
    {
        protected UserMetadata() {}

        [Required]
        public string Name { get; set; }

        [Exclude]
        public string PasswordHash { get; set; }

        [Exclude]
        public int PasswordSalt { get; set; }

        [Required]
        public string ShortName { get; set; }

        [Include]
        public IEnumerable<UserRole> UserRoles { get; set; }
    }

    [DataMember]
    [RegularExpression("^.*[^a-zA-Z0-9].*$", ErrorMessageResourceName = "BadPasswordStrength", ErrorMessageResourceType = typeof(ErrorResources))]
    [StringLength(25, MinimumLength = 6)]
    public string NewPassword { get; set; }
}

When creating a new user, the field “NewPassword” is required – but when changing properties of an existing user, it is not (it is used for password-changes).

What is the best approach to solve this? I have several ideas, but they all feels a little bit crappy 🙂

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It appears you are passing your current passwords back to the GUI. There is no need to ever do that. That would create a potential security hole

    Suggest you treat password changing as a separate service call, not just a simple record editing exercise. RIA services supports Invoke Operations which are basically arbitrary direct-calls to your RIA service. The only restriction on Invoke operations is that they cannot return complex types (not a problem for this example).

    Pass your current logged-in user identifier, the current password (encoded) and the new password (encoded) and do all the work server side. Return a simple success boolean value.

    Just some suggestions, I am happy to see other people’s ideas on this one 🙂

    • 0