Reg: SmartClient 10 migration issues in the DMI remove method

[Abdulaziz A.]

Hi Team,

We have migrated Smartclient version from 9.1 to 10.0, And we found that some of the features which were working in 9.1 is not working now.

Please let us know if something has changed to address the below issue in 10.0 version.

2) In DMI remove method we were getting all the Old values in the DSRequest in 9.1, But in 10.0 only the Primary key values are coming in the old Values.

As we are using dsRequest.OldValues in the remove method after migrating from 9.1 to 10.0 we are getting some exceptions.

We are working on the below environment:
SmartClient version : Isomorphic SmartClient/SmartGWT Framework (10.0p_2014-12-23/PowerEdition Deployment 2014-12-23)

Browser : IE9

Thanks

[Isomorphic]

As we told you just moments ago, you need to include the appropriate diagnostics - every time you post, you have to delete text that reminds of what these are.

[Abdulaziz A.]

Hi Team,

Sorry for the same mistake again.

Could you please give me a reply for the below problem. I will follow this from the next post.

In DMI remove method we were getting all the Old values in the DSRequest in 9.1, But in 10.0 only the Primary key values are coming in the old Values.

As we are using dsRequest.OldValues in the remove method after migrating from 9.1 to 10.0 we are getting some exceptions

We are using .DS.xml file as a datasource for the ListGrid. While removing a record we are not getting the oldValues in DMI remove method which we have overridden.

I didn't understand the point like " every time you post, you have to delete text that reminds of what these are ".

Thanks.

[Isomorphic]

Whenever you hit the Reply button in the forums, the text area where you type your post is initially filled with instructions that remind you of the diagnostics you always need to include when you post.

If you are somehow having trouble with this, the FAQ also contains the same list, as does the Debugging topic in the docs.

[Abdulaziz A.]

Hi Team,

I understood how to post. But for this problem do you require more information to provide a solution.

Thanks in advance.

[Isomorphic]

We're not sure how many more ways we can say it - yes, we need the standard diagnostics in order to troubleshoot this issue. We always need them.

You will save a lot of your time and our time if you make a habit of posting this information. It is always going to be requested.

[Abdulaziz A.]

Hi Team,

Please find the more information regarding the above issue.

I have created a ListGrid, And when I am trying to remove a record I am checking the old values. But these are coming as null.

Please find the below files and provide me the solution.

We are working on the below version

SmartClient version : Isomorphic SmartClient/SmartGWT Framework (10.0p_2014-02-25/PowerEdition Deployment 2014-02-25)

Browser : IE9

Thanks in advance.

[Abdulaziz A.]

Hi Team,

Please update on the above issue.

Thanks

[Isomorphic]

This is still being looked at; we've found the change involved, which was a bugfix for another issue, and we're working out a way to modify the code so that oldValues are still present and yet the original bug is still fixed.

You didn't mention how your code is using oldValues.

It would be valid to use oldValues to detect that the user is trying to remove a record that has been modified in the meantime by another user.

For most other purposes for which you might use oldValues (such as validation or user access checks), it's not secure to trust what the client submits, and you should instead retrieve other fields from the Record using a server-side DSRequest of type "fetch". If your code was using oldValues in this way, you should switch over to issuing a server-side fetch instead, and then this behavior change doesn't affect you.

[Abdulaziz A.]

Hi Team,

We have parent and child relationship in my project. While removing the child we are taking the parent record primary keys( From child record Old values because these values are there in the child record) from the child record and the updating some columns of the parent record.

Please suggest whether this case is okay to use oldv alues.

Thanks

[Isomorphic]

No definitely not. A malicious user could submit false oldValues and cause your code to delete any row in the table.

It's a good thing this behavior change caused you to re-examine your code!

We still plan to modify things so a complete set of oldValues is submitted to the server, but your corrected code will not depend on the oldValues in any case.

[Abdulaziz A.]

Hello

Still waiting the fix, This is a showstopper and stopping us from deploying the application in production

Regarding the malicious user, our application is intranet application and we are not expecting such cases to happen

[Isomorphic]

This coding issue also creates a problem if a user is editing a node that another user has placed under a different parent - that's a reason to fix it, even if you don't mind security flaws in your application.

[Abdulaziz A.]

Hi Team,

The problem which you are saying will never happen in my application because we are taking care of all these scenarios.

Please resolve this issue and let me know once the fix is ready.

[Isomorphic]

This behavior has been changed so that the full set of record values is available as dsRequest.oldValues for "remove" operations submitted by DataBoundComponents. This will be available in tomorrow's nightly build of 10.0.

Just for completeness - oldValues should not be used for either of the purposes discussed in this thread. In one case it would be a security violation, in the other, a potential correctness problem given concurrent modifications.