Pingback from  ASP.NET MVC Archived Blog Posts, Page 1

Agreed.

With Monorail you could simply have the model object as a parameter without jumping through all these hoops.

public ActionResult UpdateAddress(Address address)

it would use reflection and fill the address object from the form collection

This particular change has been biting me hard too. All my updates before used the built in method, and the closest replacement is UpdateModel. Replace I have, but now I either need to list out all the field names that /are/ valid, or do some filtering to remove all the ones that are not.

Why wasn't this method written to mimic the old behaviour and simply ignore submitted values it doesn't map? I don't need exceptions forcing me to filter out "Save.x" and "Save.y" because I am using an image to submit.

I've been updating and using 2 apps in production since P1, and this is the worst update preview so far, in terms of behaviour changes. Yes, I know it's pre-beta etc. I'm glad to be getting it. Even so, this feels like it is not road tested to the standard of the previous previews. I actually considered not updating, except I can't bare the pain I think doing 2 preview updates at once would cause me.

@Rick

"Why wasn't this method written to mimic the old behaviour and simply ignore submitted values it doesn't map? I don't need exceptions forcing me to filter out "Save.x" and "Save.y" because I am using an image to submit."

Yeah agreed.

You need to pass in the properties of the object you want to bind to into the UpdateModel method rather that the forms keys.

bsr = new BusinessSavingsRequest();

                   string[] properties = typeof(BusinessSavingsRequest).GetProperties().Select(p=> p.Name).ToArray();

                   UpdateModel(bsr, properties);

Hope this helps.

Checkout:

weblogs.asp.net/.../asp-net-mvc-preview-5-and-form-posting-scenarios.aspx

Hi there,

We don't recommend that you just update *all* properties of your object because that has the potential to be a major security problem. If a malicious user crafts a request they can set any property of your object. Instead we recommend that you use that whitelist property as it was meant to be used: Specify exactly which properties you *want* to update, and nothing more.

Nevertheless, for the next release we've made some significant improvements to model binders and UpdateModel so some of these scenarios should work much better.

Thanks,

Eilon