ASP.NET : __VIEWSTATE Bug !





1.00/5 (1 vote)
When you Try this on Asp.net 2.0 WebSite:http://www.YouWebsite/default.aspx?__VIEWSTATE=COUCOU!You will have something like that:Server Error in '/'
When you Try this on ASP.NET 2.0 WebSite:
http://www.YouWebsite/default.aspx?__VIEWSTATE=COUCOU!
You will have something like that:
Server Error in '/' Application.
Runtime Error
Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.
Details: To enable the details of this specific error message to be viewable on remote machines, please create a <customErrors> tag within a "web.config" configuration file located in the root directory of the current web application. This <customErrors> tag should then have its "mode" attribute set to "Off".
the Solution
is to Remove
__VIEWSTATE
parameter From Request.QueryString
protected override void OnInitComplete(EventArgs e) { base.OnInitComplete(e); if (Request.QueryString.ToString().Contains("__VIEWSTATE")) { // reflect to readonly property PropertyInfo isreadonly = typeof(System.Collections.Specialized.NameValueCollection).GetProperty("IsReadOnly", BindingFlags.Instance | BindingFlags.NonPublic); // make collection editable isreadonly.SetValue(this.Request.QueryString, false, null); // remove this.Request.QueryString.Remove("__VIEWSTATE"); // make collection readonly again isreadonly.SetValue(this.Request.QueryString, true, null); } }