Question

I have problem… I wrote an website and now I must secure my page. So the problem is… when user edits a entity then I should check if he is an owner of this entity. Traditionaly(without entity framework) I do it by including a where clause in sql query. For example:

update posts set
 title = "Great Post"
where 
 post_id = 5 and
 owner_id = " + CurrentLogedinUser.Id + "

But I dont know how can I do it in entity framework.

Can someone tell me?

Answer 1

In EF, you’ll typically load the item out of the context, change it, and put it back in. So you can check the value like this:

var post = context.Posts.Single(p => p.PostId == 5);
if(post.OwnerId != CurrentLoggedInUser.Id) throw new Exception("Stop hacking!");
post.title = "Great Post";
context.SaveChanges();