Trying to update a SPItem from an asp.net page and get the error “The security validation for this page is invalid”

Question

I am trying to update an SPItem from inside a asp.net page but I am getting the error

The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.

Here is the code I have:

                        SPItem item = statusList.Items[i];
                        item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
                        item["Remove"] = "";
                        SPContext.Current.Web.AllowUnsafeUpdates = true;
                        SPContext.Current.Web.Update();
                        item.Update();                            
                        Response.Redirect(Request.RawUrl);
                        SPContext.Current.Web.AllowUnsafeUpdates = false;

I have also tried

SPContext.Current.Web.Site.WebApplication.FormDigestSettings.Enabled = false;

Which gives me a permissions error.

I have tried impersonating my permissions with

                    spusertoken systoken = spcontext.current.site.systemaccount.usertoken;

                if (systoken == null)
                {
                    spsecurity.runwithelevatedprivileges(
                      delegate()
                      {
                          using (spsite site = new spsite(sharepointstate.siteurl))
                          {
                              systoken = site.systemaccount.usertoken;
                          }
                      }
                    );

                }

                using (spsite site = new spsite(sharepointstate.siteurl, systoken))
                {
                    using (spweb web = site.openweb())
                    {
                        item["notes"] = notes + "\r\nthis item was removed from the ftp server";
                        item["remove"] = "";
                        spcontext.current.web.allowunsafeupdates = true;
                        spcontext.current.web.update();

                        item.update();
                        response.redirect(request.rawurl);
                        spcontext.current.web.allowunsafeupdates = false;
                    }
                }

This also gave me the "The security validation for this page is invalid" error. And I've tried running with elevated privileges with this line:

SPSecurity.RunWithElevatedPrivileges(TestSec);
Microsoft.SharePoint.Utilities.SPUtility.ValidateFormDigest();

Here is the method that it calls:

    public void TestSec()
    {
        int i = 4;
        try
        {
            SPList statusList = SharepointState.Web.Lists.TryGetList("Status List");

            SPListItem item = statusList.Items[i];
            string name = item["Intake_ID"].ToString().Replace(':', '_');
            FTPState state = FtpClass.FTPDelete(name + ".xml");

            //delete item from status list if ftp deletion was successful or if the file wasn't found on the ftp server
            if (state.StatusDescription.Contains("250") || state.StatusDescription.Contains("550"))
            {
                string notes = string.Empty;
                if (item["Notes"] != null)
                    notes = item["Notes"].ToString();

                        item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
                        item["Remove"] = "";
                        SPContext.Current.Web.AllowUnsafeUpdates = true;
                        SPContext.Current.Web.Update();

                        item.Update();
                        Response.Redirect(Request.RawUrl);
                        SPContext.Current.Web.AllowUnsafeUpdates = false;                       


            }
        }
        catch (Exception ex)
        {
            ListErrorLogger.WriteError("REMOVE BUTTON EVENT", ex.Message, ex.StackTrace);
        }

    }

Which gave me the same "The security validation for this page is invalid". Any suggestions?

Answer 1

Couple of things with regards to your code:

You're redirecting before you try to reset AllowUnsafeUpdates. You should do this BEFORE you redirect.

Also, when you try to set properties of SharePoint object references, it's best to create a definite reference to the object first - a lot of SharePoints getters actually create new instances of objects. This might just not be the case in this instance (it is the current context, so should just use the same instance), but it's good practice if you want to access what you think is the same object more than once.

Also, you do not need to update the Web object when setting AllowUnsafeUpdates.

You seem to be redirecting back to the same page. Make sure you don't have any infinite loops occurring.

Finally, as a note, you have a "SharePointState" object with a Web property, yet you're setting the AllowUnsafeUpdates on the CurrentContext. Ensure that if you intend these two to be the same instance of an SPWeb object that they are so, otherwise you might get unexpected behaviour.

SPItem item = statusList.Items[i];
item["Notes"] = notes + "\r\nThis item was removed from the FTP server";
item["Remove"] = "";
SPWeb oWeb = SPContext.Current.Web;
oWeb.AllowUnsafeUpdates = true;
item.Update();                
oWeb.AllowUnsafeUpdates = false;            
Response.Redirect(Request.RawUrl);

Answer 2

It turns out all I had to do was grab the list and list item AFTER I allowed UnsafeUpdates.

            SPSecurity.RunWithElevatedPrivileges(delegate()
            {

                    using (SPSite site = new SPSite(SharepointState.siteUrl))
                    {
                        using (SPWeb web = site.OpenWeb())
                        {
                            site.AllowUnsafeUpdates = true;
                            web.AllowUnsafeUpdates = true;

                            SPList statusList = web.Lists.TryGetList("Status List");
                            SPItem item = statusList.Items[i];

                            item["Notes"] = "\r\nThis item was removed from the FTP server";                                
                            item["Remove"] = "";
                            item.Update();

                            web.AllowUnsafeUpdates = false;
                            site.AllowUnsafeUpdates = false;

                        }
                    }

            });

Answer 3

You probably just need a FormDigest control on the page: http://msdn.microsoft.com/en-us/library/cc768615.aspx

NOTE: Ignore bullet #2 about consolidating the app pools...not applicable.