The error occurs in an XAF ASP.NET Core application (both in Blazor and Web API Service). The error occurs when a custom function criteria operator is not processed by the SecurityFunctionPatcher logic.
ValueManager API are unavailable in standalone Web API Service and XAF Blazor application in some cases. Refer to the following Breaking Change for more details: T1121273 - Core - ValueManager API availability and deprecated static helpers in XAF .NET 6+ apps (Blazor, Web API Service, WinForms). In particular, see this section: Filtering: Custom Criteria Functions & Operators.
Workarounds
All possible workarounds are described at T1135049 - Core - The SecurityFunctionPatcher logic is not called for a non-secured XPObjectSpace. A general workaround for all usage scenarios is the use of custom 'ScopedValueAccessor', which was offered by our customer in that thread.
Known cases:
- The PersistentAlias attribute uses a custom function criteria operator:
C#[PersistentAlias("CurrentOrgId")]
Where the CurrentOrgId fuctrion uses the DevExpress.ExpressApp.SecuritySystem.Instance static property to evaluate 'CurrentOrgId' value at runtime. In this case, a general workaround is the use of custom 'ScopedValueAccessor'.
- When the IObjectSpace.GetObjectsQuery<T> method uses a property with a persistent alias attribute, which in turn uses a custom function criteria operator. Although the data is loaded via an IObjectSpace instance, the SecurityFunctionPatcher logic is not called, and the persistent alias cannot be calculated:
C#var testObject = objectSpace.GetObjectsQuery<TestObjectWithCustomCriteria>().Where(t => t.CurrentOrgId_PersistentAlias == organization.Oid);
[PersistentAlias("CurrentOrgId)")]
public Guid CurrentOrgId_PersistentAlias => //...;
- When XAF Application with security uses non-secure XPObjectSpaceProvider instead of SecuredObjectSpaceProvider to create IObjectSpace objects. Custom ObjectSpaceProvider can be used in this case (T1135049 - Core - The SecurityFunctionPatcher logic is not called for a non-secured XPObjectSpace).
- When new UnitOfWork/Session is created, this new instance doesn't call the SecurityFunctionPatcher logic:
C#using(var uow = new UnitOfWork(Session.DataLayer)) {
//... some code
}
- When the Session.Evaluate method is called directly, the SecurityFunctionPatcher logic is not called.
- When DataLayer or ObjecLayer is directly used to upload data.
Related issues:
T1147608 - Security.Blazor - The "ValueManagerContext.Storage is null" error occurs on downloading a file attachment with CurrentUserId() in PersistentAlias
T1135049 - Core - The SecurityFunctionPatcher logic is not called for a non-secured XPObjectSpace
can you share an update on this?
Hello Martin,
Our developers are working on this task. We will update this ticket when we have a reliable result.