Breaking Change T816004
Visible to All Users

Grid-like components validate column editor values against editor-specific settings and mark editors whose values do not pass validation as invalid

DevExpress Grid, Tree List, and similar components for ASP.NET WebForms and Bootstrap now enforce validation rules specified in column editor properties. We introduced this change to strengthen data security in our components.

The following editor validation settings are taken into account:

CheckBox column edit properties:

  • RequiredField (accessed through PropertiesCheckEdit.ValidationSettings.RequiredField)

TextBox column edit properties:

  • ValidationSettings (accessed through PropertiesTextEdit.ValidationSettings)
  • MaskSettings (accessed through PropertiesTextEdit.MaskSettings)
  • MaxLength (accessed through PropertiesTextEdit.MaxLength)

DateEdit column edit properties:

  • ValidationSettings (accessed through PropertiesDateEdit.ValidationSettings)
  • MinDate (accessed through PropertiesDateEdit.MinDate)
  • MaxDate (accessed through PropertiesDateEdit.MaxDate)
  • DateRangeSettings (accessed through PropertiesDateEdit.DateRangeSettings)

ComboBox column edit properties:

TokenBox column edit properties:

  • DataSecurityMode (accessed through PropertiesTokenBox.DataSecurityMode)
  • RegularExpression (accessed through PropertiesTokenBox.ValidationSettings.RegularExpression)

SpinEdit column edit properties:

  • ValidationSettings (accessed through PropertiesSpinEdit.ValidationSettings)
  • MaxLength (accessed through PropertiesSpinEdit.MaxLength)
  • MinValue (accessed through PropertiesSpinEdit.MinValue)
  • MaxValue (accessed through PropertiesSpinEdit.MaxValue)

Components save all discovered validation errors in the EditorPropertiesErrors argument of the following events:

This change may affect your application if you changes validation settings for a column editor.

Note that validation considers only editor settings specified in a column's EditProperties object and ignores settings specified in the CellEditorInitialize event handler. If you dynamically specify editor validation settings in the mentioned event handler, you need to implement your own logic to validate new/updated values manually:

  1. Handle the RowValidating event.
  2. Manually validate column editor values.
  3. Remove automatically calculated validation errors based on column settings. These errors are available in the ASPxDataValidationEventArgs.EditorPropertiesErrors object.

The following code demonstrates how to implement this task for the "Min Date" restriction specified for the Date Edit editor:

C#
protected void Grid_CellEditorInitialize(object sender, ASPxGridViewEditorEventArgs e) {     if(e.Column.FieldName == "OrderDate") {         var dateEdit = (ASPxDateEdit)e.Editor;         var userRole = Grid.GetRowValues(e.VisibleIndex, "UserRole");         if(userRole == "Manager")             dateEdit.MinDate = DateTime.Now.Date;     } } protected void Grid_RowValidating(object sender, DevExpress.Web.Data.ASPxDataValidationEventArgs e) {     var userRole = e.NewValues["UserRole"];     var orderDate = e.NewValues["OrderDate"];     var orderDateColumn = Grid.DataColumns["OrderDate"];     if(userRole == "Manager" && orderDate < DateTime.Now.Date)         e.Errors[orderDateColumn] = "You can't create order in the past";     if(e.EditorPropertiesErrors.ContainsKey(orderDateColumn))         e.EditorPropertiesErrors.Remove(orderDateColumn); // Removes automatically calculated validation errors based on column settings }

The ComboBox checks whether its edit value has a match in the item list (DataSecurityMode is set to Strict). For correct validation, specify editor properties for the item collection (DataSource, DataSourceID and Items) in a column's EditProperties object. Otherwise, validate editor values manually on the RowValidating event.

C#
protected void Grid_CellEditorInitialize(object sender, ASPxGridViewEditorEventArgs e) {     if(e.Column.FieldName == "City") {         var comboBox = (ASPxComboBox)e.Editor;         comboBox.DataSecurityMode = DataSecurityMode.Strict;         comboBox.DataSource = GetCities(Grid.GetRowValues(e.VisibleIndex, "Country"));         comboBox.DataBind();     } } protected void Grid_RowValidating(object sender, DevExpress.Web.Data.ASPxDataValidationEventArgs e) {     var cityColumn = Grid.DataColumns["City"];     var cities = GetCities(e.NewValues["Country"]);     if(!cities.Contains(e.NewValues["City"]))         e.Errors[cityColumn] = "Unknown city in the selected country.";     if(e.EditorPropertiesErrors.ContainsKey(cityColumn))         e.EditorPropertiesErrors.Remove(cityColumn); // Removes automatically calculated validation errors based on column settings }

If you wish to revert to the previous behavior, set the ASPxWebControl.BackwardCompatibility.UseEditorPropertiesInDataControlValidation property to false.

Global.asax:

C#
void Application_Start(object sender, EventArgs e) { ASPxWebControl.BackwardCompatibility.UseEditorPropertiesInDataControlValidation = false; }

Affected scenarios:

  • Initial validation

Column editors now validate their values on the server even if no changes were made on the client side. Such validation ensures that invalid values are not saved to the data source.

  • Cascading combo boxes

This change also modified the internal logic of cascading combo boxes' implementation in the ASPxComboBox control (the corresponding column's DataSecurityMode property is set to 'Strict') and the Bootstrap ComboBox (DataSecurityMode property is set to 'Strict' by default). You should bind a combo box column to a data source to allow correct user input validation. For example, if you have the 'Countries' and 'Cities' cascaded combo boxes, the dependent 'Cities' combo box should be bound to all city items so that the editor validates the user input before saving to the data source.

Refer to the demos below to see this change in action:

Bootstrap GridView - Cascading Combo Boxes
ASPxGridView - Cascading Combo Boxes

Known Issues
The official fix for the following issues will be included in version 19.2.4.

  • In a scenario where a text column (GridViewDataTextColumn) with a specific mask is used for editing non-string values (TimeSpan, Numbers, etc.) you can encounter the following issue.
    The "Invalid Value" error is shown for a corresponding editor while submitting Edit Form values even if a current editor's value is valid (matches current mask settings).
    Related ticket:
    Validation - Non-string values are incorrectly interpreted as invalid using mask validation rules while updating row values

  • If you try to submit a null value to a WebForms ComboBox column (when DataSecurityMode is set to 'Strict') or a Bootstrap ComboBox column, the control initiates server-side validation. The control searches for a database record that contains a null value and generates a validation error in the case of failure even if the AllowNull property is true.
    We fixed this issue in v19.2.4 and added an additional check for the AllowNull property value. Set this property to true for the column where null values are allowed.

Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.