How to whitelist/blacklist child object fields in the ModelBinder/UpdateModel method?

Answer 1

I have worked around this problem by making the action accepting two objects (the parent and the child object)

Example:
Suppose we have the following model:

 public class Employee
    {
        public string Name { get; set; }
        public int Age { get; set; }
        public Company Comapany { get; set; }
    }
    public class Company
    {
        public int Phone { get; set; }
    }

You build your form like this:

    <form action="Home/Create" method="post">
   <label for="Employee.Name">Name</label>
    <%=Html.TextBox("Employee.Name") %><br />
   <label for="Employee.Name">Age</label>    
    <%=Html.TextBox("Employee.Age") %><br />
   <label for="Employee.Name">Comapany Phone</label>    
    <%=Html.TextBox("Company.Phone") %><br />
    <input type="submit" value="Send" />
   </form>

Then build a "Create" action that accept two objects one of type Employee and the other of type Comapny and assign the Company object to the Employee.Company property inside the action:

 public ActionResult Create(Employee employee,Company company)
        {
            employee.Comapany = company;
            UpdateModel(employee);
            return View();
        }

I hope this help you.

Edit:

public ActionResult Create(Employee employee,Company company)
{
   employee.Comapany = company;
   UpdateModel(employee,new[] {"Name","Email","Phone"});
   return View();
}

Answer 2

In general, the best way to go is to create view-models, models built specifically for your views. These models are not domain objects. They are data-transfer objects, built to transfer data from your controller actions to your view templates. You can use a tool like AutoMapper painlessly to create/update a domain model object from your view-model object or to create/update a view-model object from your domain model.

Answer 3

Have you tried using the following?:

public ActionResult Create([Bind(Exclude="PropertyToExclude1, PropertyToExclude2")] Employee employee) {

//action code here

}

or use Include instead of Exclude to List what fields can be bound rather than which can't