Generic Type Model Binding and the BindAttribute

Question

I'm running into an issue with the bind attribute in asp.net mvc. I have a custom ViewModel that looks like this:

public interface IUserView<TUser> where TUser : User
{
    TUser User { get; set; }
    string Email { get; set; }
    string ConfirmEmail { get; set; }
    string Password { get; set; }
    string ConfirmPassword { get; set; }
}
public class EditUserView<TUser> : IUserView<TUser> where TUser : User
{
    public virtual TUser User { get; set; }

    [ValidateRegExp(RegexConstants.Email, "Invalid Email.")]
    [ValidateNonEmpty("email is required.")]
    public virtual string Email { get; set; }

    [ValidateSameAs("Email", "confirmation email does not match.")]
    public virtual string ConfirmEmail { get; set; }


    public virtual string Password { get; set; }

    [ValidateSameAs("Password", "confirmation password does not match.")]
    public virtual string ConfirmPassword { get; set; }
}

and a method to submit this that looks like this:

public ActionResult SubmitProfile([Bind(Exclude="IsSystemAdmin")]EditUserView<Admin> iuserview)

if you look at the above method you'll notice the bind attribute with 'Exclude="IsSystemAdmin"'. The admin model has a boolean property named "IsSystemAdmin" that bumps their permission level up. Now obviously I don't want an admin to be able to make themself a system admin just by posting back a true value for this field.

I have tried both "IsSystemAdmin" and "User.IsSystemAdmin" in the exclude property and neither of them stop the IsSystemAdmin variable from getting updated. Is there a way to make the bind attribute work in this scenario, or is this a bug in the Default model binder?

Answer 1

Have you tried using the Bind attribute on the TUser class itself

[Bind(Exclude = "IsSysAdmin")]
public class TUser 
{

}

I think that because of the importance of this property you will never want this to be set by a model binder and hence the bind on the class will be ok. Most likely you increase an Admin to sysadmin by explicitly setting the flag on an action.

I am very wary of binding any Model classes directly from form posts. I have specific form classes for the bind and update model classes in my repository layer only via another service layer.