Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am using SharePoint Server 2007 Enterprise with Windows Server 2008 Enterprise. I have deployed a publishing portal. I am developing a ASP.Net web application using VSTS 2008 + C# + .Net 3.5 + ASP.Net + SharePoint Server 2007 SDK.

Here is my code snippets and I got error -- "Updates are currently disallowed on GET requests". Any ideas how to fix?

Microsoft.SharePoint.SPException: Updates are currently disallowed on GET requests. To allow updates on a GET, set the 'AllowUnsafeUpdates' property on SPWeb.

        protected void Page_Load(object sender, EventArgs e)
        {
            try
            {
                SPWebApplication webApp = SPContext.Current.Site.WebApplication;
                SPSiteCollection siteCollections = webApp.Sites;
                foreach (SPSite item in siteCollections)
                {
                    SPWeb webItem = item.OpenWeb();
                    webItem.AllowUnsafeUpdates = true;
                }

                SPSite newSiteCollection = siteCollections.Add("sites/myblog",
                    "New Sample Site", "New Sample Site Description", 1033, "BLOG#0",
                    "foo\\foouser", "Owner name", "owneremail@foo.com");
            }
            catch (Exception ex)
            {
                Response.Write(ex.ToString() + "\t" + ex.StackTrace);
            }
        }

Update 1: I met with the same error with the following code,

        SPContext.Current.Web.AllowUnsafeUpdates = true;
        SPWebApplication webApp = SPContext.Current.Site.WebApplication;
        SPSiteCollection siteCollections = webApp.Sites;
        /*
        foreach (SPSite item in siteCollections)
        {
            SPWeb webItem = item.OpenWeb();
            webItem.AllowUnsafeUpdates = true;
        }
        */
            SPSite newSiteCollection = siteCollections.Add("sites/myblog",
                "New Sample Site", "New Sample Site Description", 1033, "BLOG#0",
                "foo\\foouser", "Owner name", "owneremail@foo.com");
share|improve this question
2  
Hi, can you please clarify what you are trying to achieve. Is the purpose creating a site collection on a page load? –  Wictor Wilen MCA MCM MVP Feb 23 '10 at 14:14
    
I want to achieve the purpose of letting user be able to click a button on SharePoint site, then a web site is created. Any ideas for better solution? –  George2 Feb 24 '10 at 4:49
1  
the problem here is that you do not run the code when the button is clicked (that would be a postback/POST request) but in the page load (not necesarily a postback). move your code to the on_click button event handler and it should work without setting AllowUnsafeUpdates (this is only relevant for GET requests) –  Anders Rask Feb 24 '10 at 9:18
    
"move your code to the on_click button event handler" -- can you show me how? Currently my html code inside webpart looks like <button type=\"button\" onclick=\"location.href = 'localhost/_layouts/testfoo.aspx';; return false\" >Click me!</button> –  George2 Feb 24 '10 at 13:44
3  
George: sorry, im not giving classes in basic C# event handling. Google is your friend if you havent used server side click events –  Anders Rask Feb 24 '10 at 14:48

3 Answers 3

up vote 3 down vote accepted

Be aware that SPSite also has an AllowUnsafeUpdates property that you can try.

If you change this, do it inside a try/finally so that you are sure not to make your site vounerable to cross-side scripting attacks (it would seem from your code sample that you already have bypassed the XSS protection from all your sub-sites, so you might want to enable that again!).

Eventually the AllowUnsafeUpdates property will be reset to its default value (any operation that call SPWeb.Invalidate() amongst others), but until then your site will be prone to XSS attacks.

share|improve this answer
    
I want to achieve the purpose of letting user be able to click a button on SharePoint site, then a web site is created. In this scenario, should I use SPSite or SPWeb? –  George2 Feb 24 '10 at 4:51
    
As i mention in the comment to the question, you should work towards avoiding GET requests (and disabling XSS protection in process) if at all possible –  Anders Rask Feb 24 '10 at 16:43
    
Question answered! –  George2 Feb 25 '10 at 5:09

I think you need to set AllowUnsafeUpdates on the Web that is invoking this code.

bool currentSetting = SPContext.Current.Web.AllowUnsafeUpdates;
SPContext.Current.Web.AllowUnsafeUpdates = true;

... do your work here

SPContext.Current.Web.AllowUnsafeUpdates = currentSetting;
share|improve this answer
    
I met with the same error when using your solution, please refer to Update 1 part of my original reply. Any ideas? –  George2 Feb 23 '10 at 13:48
2  
its a best practice to do the above inside a try/finally to ensure your code dont break before setting back your spweb security settings –  Anders Rask Feb 23 '10 at 14:14
    
I add the code into a try\catch block, but met with the same error -- "Updates are currently disallowed on GET requests". Any ideas how to fix? –  George2 Feb 23 '10 at 14:23
1  
Make sure to set AllowUnsafeUpdates on the correct scope (SPSite vs SPWeb) –  Wictor Wilen MCA MCM MVP Feb 23 '10 at 14:26
    
I want to achieve the purpose of letting user be able to click a button on SharePoint site, then a web site is created. In this scenario, should I use SPSite or SPWeb? –  George2 Feb 24 '10 at 4:49

If you really want to do this with a GET-request, performing 'SPUtility.ValidateFormDigest()' should also do the trick, without needing to touch the AllowUnsafeUpdates property (which is really something you should avoid, in my opinion)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.