c# - ASP.NET MVC 应用程序有 SecurityException

标签 c# asp.net asp.net-mvc

<分区>

我正在尝试让 ASP.NET MVC 应用程序正常工作...我应该知道这并不容易。前几页有效,但它们都是静态的。第一次执行 Controller 时,出现以下异常。

这是 Controller 操作方法:

[AcceptVerbs(HttpVerbs.Get)]
public ActionResult Index(Section? section, int? parent)
{
    if (section == null)
    {
        return RedirectToAction("Index", "Questions", new {section = Section.Section0});
    }

    IPagedList<Question> questions = _surveyService.FetchQuestions(User.Identity.Name, section.Value, parent);

    // ...

    ViewResult result = View("Index", questions);
    result.ViewData.Add("CurrentSection", section.Value);
    result.ViewData.Add("Parent", parent);
    result.ViewData.Add("IsLastPage", questions.IsLastPage);

    return result;
}

RedirectToAction() 方法的第二行抛出异常。

背景:

  • 我已按照 this answer 中的说明进行操作.
  • 我没有在我的代码中明确使用反射或要求安全性。
  • 我正在使用 MVCLINQ to SQLElmah , 和 PagedList .
  • 我正在使用 IIS 7 集成模式。
  • 我添加了 [程序集: AllowPartiallyTrustedCallers] 到我的 AssemblyInfo.cs。我这样做是因为我发现另一个 Stack Overflow 问题有一个推荐它的答案(我现在找不到它,否则我会提供一个链接)。我还按照 Rex M 在下面的回答中建议的方式为我的程序集命名。

我缺少什么来完成这项工作?

异常:

Server Error in '/surveys/objectification' Application.
    Security Exception
    Description: The application attempted to perform an operation not allowed by the security policy.  To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

    Exception Details: System.Security.SecurityException: That assembly does not allow partially trusted callers.

    Source Error:

    An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

    Stack Trace:

    [SecurityException: That assembly does not allow partially trusted callers.]
       SelfObjectificationSurvey.Web.Controllers.QuestionsController.Index(Nullable`1 section, Nullable`1 parent) +0
       lambda_method(ExecutionScope , ControllerBase , Object[] ) +123
       System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +17
       System.Web.Mvc.ReflectedActionDescriptor.Execute(ControllerContext controllerContext, IDictionary`2 parameters) +178
       System.Web.Mvc.ControllerActionInvoker.InvokeActionMethod(ControllerContext controllerContext, ActionDescriptor actionDescriptor, IDictionary`2 parameters) +24
       System.Web.Mvc.<>c__DisplayClassa.<InvokeActionMethodWithFilters>b__7()
+53
       System.Web.Mvc.ControllerActionInvoker.InvokeActionMethodFilter(IActionFilter filter, ActionExecutingContext preContext, Func`1 continuation) +258
       System.Web.Mvc.<>c__DisplayClassc.<InvokeActionMethodWithFilters>b__9()
+20
       System.Web.Mvc.ControllerActionInvoker.InvokeActionMethodWithFilters(ControllerContext controllerContext, IList`1 filters, ActionDescriptor actionDescriptor, IDictionary`2 parameters) +193
       System.Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerContext controllerContext, String actionName)
+382
       System.Web.Mvc.Controller.ExecuteCore()
+123
       System.Web.Mvc.ControllerBase.Execute(RequestContext requestContext) +23
       System.Web.Mvc.ControllerBase.System.Web.Mvc.IController.Execute(RequestContext requestContext) +7
       System.Web.Mvc.MvcHandler.ProcessRequest(HttpContextBase httpContext) +144
       System.Web.Mvc.MvcHandler.ProcessRequest(HttpContext httpContext) +54
       System.Web.Mvc.MvcHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext httpContext) +7
       System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
+181
       System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
+75


    Version Information: Microsoft .NET Framework Version:2.0.50727.3074; ASP.NET Version:2.0.50727.4049

最佳答案

您可能需要检查的另一件事是,根据此 article , 有一些 .NET 类型不能在部分受信任的程序集中使用,即使它已使用 AllowPartiallyTrustedCallersAttribute 修饰。

参见 .NET Framework Assemblies and the AllowPartiallyTrustedCallers Attribute获取完整列表。

更新 2 您确定您正在调用的所有第三方程序集也都装饰有 AllowPartiallyTrustedCallers 属性吗?

例如,查看 PagedList 1.1 的 AssemblyInfo.cs,它似乎不包含此属性。

更新 1:您是对的,不可用类型列表看起来确实过时了。

LINQ to SQL FAQ 有一些关于它在部分信任环境中的使用的有趣信息:

APTCA

Q. Is System.Data.Linq marked for use by partially trusted code?

A. Yes, the System.Data.Linq.dll assembly is among those .NET Framework assemblies marked with the AllowPartiallyTrustedCallersAttribute attribute. Without this marking, assemblies in the .NET Framework are intended for use only by fully trusted code.

The principal scenario in LINQ to SQL for allowing partially trusted callers is to enable the LINQ to SQL assembly to be accessed from Web applications, where the trust configuration is Medium.

关于c# - ASP.NET MVC 应用程序有 SecurityException,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/1484431/

相关文章:

c# - 在 Web.Config 中限制 URL 参数长度

c# - 用户在View中修改model的隐藏值(@Html.HiddenFor)

c# - 需要将字符串解析为 mm :ss not as hh:mm

ASP.NET - 使用 AJAX 加载用户控件?

asp.net-mvc - 如何将模型元数据重用于自定义 View 模型?

javascript - jQuery 调用 Controller 的操作

c# - Azure:如何从服务总线队列中删除 "DeadLettered"消息

c# - Connection was not closed, Connection's current state is open error in foreach 循环

asp.net - 如何从 CSS 引用嵌入图像?

c# - 如何将 Div id 作为参数传递给 C# 函数?