Improving the Details and Delete Methods

不念不忘少年蓝@ 2022-10-10 04:57 136阅读 0赞

In this part of the tutorial, you'll make some improvements to the automatically generated `Details` and `Delete` methods. These changes aren't required, but with just a few small bits of code, you can easily enhance the application.

## Improving the Details and Delete Methods ##

When you scaffolded the `Movie` controller, ASP.NET MVC generated code that worked great, but that can be made more robust with just a few small changes.

Open the `Movie` controller and modify the `Details` method by returning `HttpNotFound` when a movie isn't found. You should also modify the `Details` method to set a default value for the ID that's passed to it. (You made similar changes to the `Edit` method in [ part 6 ][part 6]of this tutorial.) However, you must change the return type of the `Details` method from `ViewResult` to `ActionResult`, because the `HttpNotFound` method doesn't return a `ViewResult` object. The following example shows the modified `Details` method.

public ActionResult Details(int id = 0)
    {
       
        Movie movie = db.Movies.Find(id);
        if (movie == null)
        {
       
            return HttpNotFound();
        }
        return View(movie);
    }

Code First makes it easy to search for data using the `Find` method. An important security feature that we built into the method is that the code verifies that the `Find` method has found a movie before the code tries to do anything with it. For example, a hacker could introduce errors into the site by changing the URL created by the links from *http://localhost:xxxx/Movies/Details/1* to something like *http://localhost:xxxx/Movies/Details/12345* (or some other value that doesn't represent an actual movie). If you don't the check for a null movie, this could result in a database error.

Similarly, change the `Delete` and `DeleteConfirmed` methods to specify a default value for the ID parameter and to return `HttpNotFound` when a movie isn't found. The updated `Delete` methods in the `Movie` controller are shown below.

// GET: /Movies/Delete/5
    
    public ActionResult Delete(int id = 0)
    {
       
        Movie movie = db.Movies.Find(id);
        if (movie == null)
        {
       
            return HttpNotFound();
        }
        return View(movie);
    }
    
    //
    // POST: /Movies/Delete/5
    
    [HttpPost, ActionName("Delete")]
    public ActionResult DeleteConfirmed(int id = 0)
    {
       
        Movie movie = db.Movies.Find(id);
        if (movie == null)
        {
       
            return HttpNotFound();
        }
        db.Movies.Remove(movie);
        db.SaveChanges();
        return RedirectToAction("Index");
    }

Note that the `Delete` method doesn't delete the data. Performing a delete operation in response to a GET request (or for that matter, performing an edit operation, create operation, or any other operation that changes data) opens up a security hole. For more information about this, see Stephen Walther's blog entry [ ASP.NET MVC Tip \#46 — Don't use Delete Links because they create Security Holes][ASP.NET MVC Tip _46 _ Don_t use Delete Links because they create Security Holes].

The `HttpPost`method that deletes the data is named `DeleteConfirmed`to give the HTTP POST method a unique signature or name. The two method signatures are shown below:

// GET: /Movies/Delete/5
    public ActionResult Delete(int id = 0)
    
    //
    // POST: /Movies/Delete/5
    [HttpPost, ActionName("Delete")]
    public ActionResult DeleteConfirmed(int id = 0)

The common language runtime (CLR) requires overloaded methods to have a unique signature (same name, different list of parameters). However, here you need two Delete methods -- one for GET and one for POST -- that both require the same signature. (They both need to accept a single integer as a parameter.)

To sort this out, you can do a couple of things. One is to give the methods different names. That's what we did in he preceding example. However, this introduces a small problem: ASP.NET maps segments of a URL to action methods by name, and if you rename a method, routing normally wouldn't be able to find that method. The solution is what you see in the example, which is to add the `ActionName("Delete")` attribute to the `DeleteConfirmed`method. This effectively performs mapping for the routing system so that a URL that includes */Delete/* for a POST request will find the `DeleteConfirmed`method.

Another way to avoid a problem with methods that have identical names and signatures is to artificially change the signature of the POST method to include an unused parameter. For example, some developers add a parameter type `FormCollection`that is passed to the POST method, and then simply don't use the parameter:

public ActionResult Delete(FormCollection fcNotUsed, int id = 0)
    {
       
        Movie movie = db.Movies.Find(id);
        if (movie == null)
        {
       
            return HttpNotFound();
        }
        db.Movies.Remove(movie);
        db.SaveChanges();
        return RedirectToAction("Index");
    }

## Wrapping Up ##

You now have a complete ASP.NET MVC application that stores data in a SQL Server Compact database. You can create, read, update, delete, and search for movies.

![WindowsLiveWriter_AddingaNewFieldtotheMovieModelandTable_E60A_8_format_SM_9cb96bbf-d5c3-4e6e-b816-43bd43ee2b3b.png_cdn_id_2013-08-19-002][]

This basic tutorial got you started making controllers, associating them with views, and passing around hard-coded data. Then you created and designed a data model. Entity Framework Code First created a database from the data model on the fly, and the ASP.NET MVC scaffolding system automatically generated the action methods and views for basic CRUD operations. You then added a search form that let users search the database. You changed the database to include a new column of data, and then updated two pages to create and display this new data. You added validation by marking the data model with attributes from the `DataAnnotations` namespace. The resulting validation runs on the client and on the server.

If you'd like to deploy your application, it's helpful to first test the application on your local IIS 7 server. You can use this [ Web Platform Installer][Web Platform Installer] link to enable IIS setting for ASP.NET applications. See the following deployment links:

*  [ASP.NET Deployment Content Map][]
 *  [Enabling IIS 7.x ][Enabling IIS 7.x]
 *  [Web Application Projects Deployment ][ASP.NET Deployment Content Map]

I now encourage you to move on to our intermediate-level [ Creating an Entity Framework Data Model for an ASP.NET MVC Application][Creating an Entity Framework Data Model for an ASP.NET MVC Application] and [ MVC Music Store][MVC Music Store] tutorials, to explore the [ ASP.NET articles on MSDN][ASP.NET articles on MSDN], and to check out the many videos and resources at [ http://asp.net/mvc][http_asp.net_mvc] to learn even more about ASP.NET MVC! The [ ASP.NET MVC forums][ASP.NET MVC forums] are a great place to ask questions.

Enjoy!

— Scott Hanselman ([http://hanselman.com][http_hanselman.com] and [@shanselman][shanselman] on Twitter) and Rick Anderson [blogs.msdn.com/rickAndy][blogs.msdn.com_rickAndy]

[part 6]: http://www.asp.net/mvc/tutorials/getting-started-with-aspnet-mvc3/cs/examining-the-edit-methods-and-edit-view
[ASP.NET MVC Tip _46 _ Don_t use Delete Links because they create Security Holes]: http://stephenwalther.com/blog/archive/2009/01/21/asp.net-mvc-tip-46-ndash-donrsquot-use-delete-links-because.aspx
[WindowsLiveWriter_AddingaNewFieldtotheMovieModelandTable_E60A_8_format_SM_9cb96bbf-d5c3-4e6e-b816-43bd43ee2b3b.png_cdn_id_2013-08-19-002]: http://i1.asp.net/media/2578720/WindowsLiveWriter_AddingaNewFieldtotheMovieModelandTable_E60A_8_format_SM_9cb96bbf-d5c3-4e6e-b816-43bd43ee2b3b.png?cdn_id=2013-08-19-002
[Web Platform Installer]: http://www.microsoft.com/web/gallery/install.aspx?appsxml=&appid=ASPNET;
[ASP.NET Deployment Content Map]: http://msdn.microsoft.com/en-us/library/dd394698.aspx
[Enabling IIS 7.x]: http://blogs.msdn.com/b/rickandy/archive/2011/03/14/enabling-iis-7-x-on-windows-7-vista-sp1-windows-2008-windows-2008-r2.aspx
[Creating an Entity Framework Data Model for an ASP.NET MVC Application]: http://www.asp.net/entity-framework/tutorials/creating-an-entity-framework-data-model-for-an-asp-net-mvc-application
[MVC Music Store]: http://www.asp.net/mvc/tutorials/mvc-music-store-part-1
[ASP.NET articles on MSDN]: http://msdn.microsoft.com/en-us/library/gg416514%28VS.98%29.aspx
[http_asp.net_mvc]: http://asp.net/mvc
[ASP.NET MVC forums]: http://forums.asp.net/1146.aspx
[http_hanselman.com]: http://hanselman.com/
[shanselman]: http://twitter.com/shanselman
[blogs.msdn.com_rickAndy]: http://blogs.msdn.com/rickAndy