Can a client get to a button click event programmatically if the button is not rendered? [duplicate]

Question

This is in ASP.NET web forms, I have a save button on a screen. When I load the page initially, under certain conditions, the save button is not rendered.

button1.visible = false

In my button clicked event, I have this

public void button1_click(Object sender, EventArgs e)
{
    SaveData();
}

The only security preventing the user being from being saved is on whether the save button is rendered.

In MVC, it would be trivial to access the save button action method just by making a HTTP POST to the server with my own modified request.

In ASP.NET Web forms, I'm a little bit confused because it relies on the encrypted ViewState being posted back. Do I still need to add this security to the button1_click event too? If so, then can you tell me how a client can fire a postback to the server that would reach the button click event without the button being visible?

Answer 1

That is one of the common mistakes about ViewState - it DOES NOT serve your click events and many other things.

Each click on button (or checkbox if autopostback is enabled) raises an form submitting to server. And all info about what was clicked is included in form postback data as plain text. Then server parses this data and, as your button has IPostBackDataHandler implemented, it raises appropriate events like "button id has been clicked". So, you can actually change request body:

D__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPD...&ctl00%24_pdContent%24txtEmail=qwe%40aeqw.ry&ctl00%24_pdContent%24btnRtnUser=Login&__EVENTVALIDATION=%2FwEWDAL424aUAQLjtYbqCAKu8qTUCQLXm%2BfNAwKk2O%2B4DgK3ypStCAL6q%2BaACgKBnvb9CQLr8ey6CALxoZvDCALFt96ABgLMorjMAwoW3zW69NNlOXygWNnB6luGVWnk

Above you can see content of input with id=ctl00__pdContent_txtEmail and clicked login button with id=ctl00__pdContent_btnRtnUser.

More explanation about server events in WebForms here.

And please read more about ViewState here or even better explanation here.

Answer 2

https://stackoverflow.com/a/24064375/279911

According to this answer on another question, it looks like it is impossible to reach the button click event if the button is not rendered as long as you have the relevant security settings set.

Yes, setting a button's Visible property to false is enough to prevent its Click and Command events from being raised, as long as you don't turn off the default ASP.NET security features.