Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am trying to update an SPItem from inside a asp.net page but I am getting the error

The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.

Here is the code I have:

                        SPItem item = statusList.Items[i];
                        item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
                        item["Remove"] = "";
                        SPContext.Current.Web.AllowUnsafeUpdates = true;
                        SPContext.Current.Web.Update();
                        item.Update();                            
                        Response.Redirect(Request.RawUrl);
                        SPContext.Current.Web.AllowUnsafeUpdates = false;

I have also tried

SPContext.Current.Web.Site.WebApplication.FormDigestSettings.Enabled = false;

Which gives me a permissions error.

I have tried impersonating my permissions with

                    spusertoken systoken = spcontext.current.site.systemaccount.usertoken;

                if (systoken == null)
                {
                    spsecurity.runwithelevatedprivileges(
                      delegate()
                      {
                          using (spsite site = new spsite(sharepointstate.siteurl))
                          {
                              systoken = site.systemaccount.usertoken;
                          }
                      }
                    );

                }

                using (spsite site = new spsite(sharepointstate.siteurl, systoken))
                {
                    using (spweb web = site.openweb())
                    {
                        item["notes"] = notes + "\r\nthis item was removed from the ftp server";
                        item["remove"] = "";
                        spcontext.current.web.allowunsafeupdates = true;
                        spcontext.current.web.update();

                        item.update();
                        response.redirect(request.rawurl);
                        spcontext.current.web.allowunsafeupdates = false;
                    }
                }

This also gave me the "The security validation for this page is invalid" error. And I've tried running with elevated privileges with this line:

SPSecurity.RunWithElevatedPrivileges(TestSec);
Microsoft.SharePoint.Utilities.SPUtility.ValidateFormDigest();

Here is the method that it calls:

    public void TestSec()
    {
        int i = 4;
        try
        {
            SPList statusList = SharepointState.Web.Lists.TryGetList("Status List");

            SPListItem item = statusList.Items[i];
            string name = item["Intake_ID"].ToString().Replace(':', '_');
            FTPState state = FtpClass.FTPDelete(name + ".xml");

            //delete item from status list if ftp deletion was successful or if the file wasn't found on the ftp server
            if (state.StatusDescription.Contains("250") || state.StatusDescription.Contains("550"))
            {
                string notes = string.Empty;
                if (item["Notes"] != null)
                    notes = item["Notes"].ToString();

                        item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
                        item["Remove"] = "";
                        SPContext.Current.Web.AllowUnsafeUpdates = true;
                        SPContext.Current.Web.Update();

                        item.Update();
                        Response.Redirect(Request.RawUrl);
                        SPContext.Current.Web.AllowUnsafeUpdates = false;                       


            }
        }
        catch (Exception ex)
        {
            ListErrorLogger.WriteError("REMOVE BUTTON EVENT", ex.Message, ex.StackTrace);
        }

    }

Which gave me the same "The security validation for this page is invalid". Any suggestions?

share|improve this question
add comment

3 Answers

Couple of things with regards to your code:

You're redirecting before you try to reset AllowUnsafeUpdates. You should do this BEFORE you redirect.

Also, when you try to set properties of SharePoint object references, it's best to create a definite reference to the object first - a lot of SharePoints getters actually create new instances of objects. This might just not be the case in this instance (it is the current context, so should just use the same instance), but it's good practice if you want to access what you think is the same object more than once.

Also, you do not need to update the Web object when setting AllowUnsafeUpdates.

You seem to be redirecting back to the same page. Make sure you don't have any infinite loops occurring.

Finally, as a note, you have a "SharePointState" object with a Web property, yet you're setting the AllowUnsafeUpdates on the CurrentContext. Ensure that if you intend these two to be the same instance of an SPWeb object that they are so, otherwise you might get unexpected behaviour.

SPItem item = statusList.Items[i];
item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
item["Remove"] = "";
SPWeb oWeb = SPContext.Current.Web;
oWeb.AllowUnsafeUpdates = true;
item.Update();                
oWeb.AllowUnsafeUpdates = false;            
Response.Redirect(Request.RawUrl);
share|improve this answer
    
Thank you, I will create a SPWeb object. As for the redirecting, I tried redirecting after I reset the UnsafeUpdates, but either way, the error was being thrown at the item.Update() line. I am purposely trying to redirect to the same page so it refreshes once the item has been updated. –  Meyer Denney Aug 10 '11 at 16:17
add comment

You probably just need a FormDigest control on the page: http://msdn.microsoft.com/en-us/library/cc768615.aspx

NOTE: Ignore bullet #2 about consolidating the app pools...not applicable.

share|improve this answer
    
I tried that but no luck. I still got the same "The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again." even with this line of code Microsoft.SharePoint.Utilities.SPUtility.ValidateFormDigest(); By PageURI did they want the full address or just the page address? –  Meyer Denney Aug 10 '11 at 18:22
    
PageURI is optional. You also wouldn't need any of the AllowUnsafeUpdates stuff, the update on the oWeb, or the redirect (...if a refresh is needed you should take whatever you're doing in your page_load, put it in it's own routine, and call that routine at the bottom of your TestSec routine). It really shouldn't be more than updating the item properties and calling the Update method. –  Rob D'Oria Aug 10 '11 at 20:01
    
Thank you for the info. I am still having trouble though (regardless of including or not including AllowUnsafeUpdates, FormDigest, impersonation, etc). This code is not in the page_load event, its in an onClick event. Do you know of a workaround I could do to make this work? –  Meyer Denney Aug 10 '11 at 21:08
    
Can you post the ASPX file...or it's contents? Want to see the structure of the page to see if there's something there that is causing this. How are you deploying this page to your SharePoint site? ...and how is it invoked? –  Rob D'Oria Aug 10 '11 at 21:25
add comment
up vote 0 down vote accepted

It turns out all I had to do was grab the list and list item AFTER I allowed UnsafeUpdates.

            SPSecurity.RunWithElevatedPrivileges(delegate()
            {

                    using (SPSite site = new SPSite(SharepointState.siteUrl))
                    {
                        using (SPWeb web = site.OpenWeb())
                        {
                            site.AllowUnsafeUpdates = true;
                            web.AllowUnsafeUpdates = true;

                            SPList statusList = web.Lists.TryGetList("Status List");
                            SPItem item = statusList.Items[i];

                            item["Notes"] = "\r\nThis item was removed from the FTP server";                                
                            item["Remove"] = "";
                            item.Update();

                            web.AllowUnsafeUpdates = false;
                            site.AllowUnsafeUpdates = false;

                        }
                    }

            });
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.