ASP.NET

Upgrading to subtext 2.0-fail

Brendan Kowitz — Fri, 15 Aug 2008 13:55:40 GMT

It's been a long time in between updates for subtext, but, has it actually been worth it? Well, kinda. Compared to the 1.9.5 release this one seems a little rough around the edges.

If you're on a shared host WITHOUT full trust, beware! Things will break in multiple places, including:

~~DTP.aspx (The homepage) (tag "st" undefined, needed to add back 'Register TagPrefix="st" Namespace="Subtext.Web.UI.WebControls"')~~ (My web.config merge error)
/admin/Posts/ (EnclosureMimetypes config section missing requirePermission="false" attribute)
/admin/Feedback/ ("FeedbackStatusFlag" undeclared, needed to prefix with the namespace)
Subtext.Framework.UrlManager.UrlReWriteHandlerFactory.GetHandlerForUrl(string url) also breaks from a security permission when calling UrlAuthorizationModule.CheckUrlAccessForPrincipal(), had to recompile Subtext.Framework to get around this.

EDIT: I don't mean to blast subtext, but I might as well lay a few more issues out there:

The call to "/Admin/Services/Ajax/AjaxServices.ashx?proxy" throws an "Operation could destabilize the runtime" exception, haha I must say this is the first time I've seen that, fixed by generating the AjaxServicesProxy.js file locally.
In the Feedback admin area, when hovering the URL icon the "title" tag shows the email address.
Forgot to add this last night: Had to remove the OpenID stuff from the login page, errors with "Cannot be called from Untrusted assembly".

The problems in this upgrade mostly appear to be stemming from carelessness regarding restrictions in medium trust. I guess the question is - "Is subtext venturing away from medium trust on purpose?"

Looking to the future. From what I recall I don’t think it’s actually possible to run .net 3.5 applications without full trust, features such as anonymous types simply don’t work.

NHibernate Compatible Shared Hosts

Brendan Kowitz — Fri, 28 Mar 2008 13:21:04 GMT

NHibernate is a remarkable ORM, however with all the magic comes a few caveats, these being the difficulties running NHibernate apps in a shared hosting environment. I'm still convinced that it's entirely possible, so I've decided to start compiling a list of success and failures that others (and myself) have had in getting things working.

Compatible Shared Hosts

Host Name	Comment	Reference
Webhost4life	Reportedly works with "no hacks"	[ref]
DiscountAsp	I think this should work with IIS7 / Win 2008	[ref]
XHostSolutions	Simply email support and ask to have your application run as Full Trust	This is the host I use.

Shared Hosts known not to work

Host Name	Comment	Reference
Godaddy		[ref]
Crystaltech		[ref]

Untested / Unknown

Host Name	Comment	Reference
DiscountAsp

Useful References / Alternate Ideas

Lazy Loading with nHibernate Under Medium Trust

Graffiti Cms by Telligent

Brendan Kowitz — Thu, 21 Feb 2008 12:16:05 GMT

There are a fair few CMS solutions floating around in .NET at the moment, a good general comparison tool can be found at CmsMatrix.org.

Cuyahoga

In the past, the Cuyahoga Website Framework has looked always fairly interesting, it is also built on NHibernate which to me is a plus. Most things I've done with NHibernate have generally "just worked", maybe it's because NHibernate development is pounded with unit tests, whatever it is, it works.

I haven't had any experience developing any extensions for Cuyahoga, so I don't know exactly how extensible it is yet. In terms of usability, I did find the interface a little confusing at first. The admin section is only used to configure modules/pages..etc.. but to actually edit the content I needed to visit the actual page in admin mode and click edit module (DNN Style).

Graffiti

Graffiti CMS has only recently come to my attention. I remember only in the later half of last year reading about Telligent acquiring Dozing Dogs CMS and wondering at the time, what they were going to do with it, well, now days, there is no sign of Dozing Dogs. Instead, earlier this week Telligent released Graffiti CMS which appears to be completely new as a full version 1.0.

Graffiti supports a variety of databases including VistaDB (default), MS Sql and MySql. Not only that, but they claim its mono-compatible, so it is able to be run on linux and other mono supported platforms.

Test Run of Graffiti

Setup was really simple, xcopy, run. With not much more thought then that, your away.

The dashboard of Graffiti looks fantastic. I've always been a fan of having an area dedicated to admin tasks, as opposed to having admin controls stuffed into a site's design, as done by DNN. The only thing that wasn't obvious in Graffiti is the fact that there are no "pages". All content appears to be considered a "post". The "posts" are configurable in a way that is easy to set them up in a blog style behavior, or leave them detached, essentially making them pages.

Some of the highlights that stood out to me immediately

Seems to use NVelocity templates to render out HTML, meaning it's lean and clean
Supports a programmable API -- MetaWeblog
Supports its own extensibility though Widgets
Widgets can be installed in literally 2 clicks
Admin dashboard is slick
Free express version

Again, from observation, there are a couple of cons too

"Posts" appear to be rendered out into files on the disk, (like MovableType) this certainly got people that owned large blogs into trouble.

I did get the feeling that I'd seen an admin area that looked similar...Graffiti even has fading panels at the top of the screen when you make a change...

In any case, Graffiti seems like something that should be watched in future. It may already be a great solution for a small - medium site. I do think that a site with a lot of pages may become a little unwieldy in the current interface, especially if changes need to be made across many pages, or you want to switch to a new theme.

IDataErrorInfo for ASP.NET

Brendan Kowitz — Thu, 08 Nov 2007 13:42:42 GMT

As far as I'm aware ASP.NET doesn't support IDataErrorInfo, I've asked about this in many places, including Tech.Ed '07 with no success. The closest things I've seen in terms of Business Object level validation is from Enterprise Library validation block (which is attribute based and can render out with custom EntLib web controls) and another example in the Futures Dynamic Data Controls using Linq (I have no idea how this magic validation magically appears).

It all just seems overly complicated, so, have a look at the IDataErrorInfo interface the methods are:

string this [ string columnName ] { get; }
string Error { get; }

Simple and generic. I've been playing around with an idea about how to get this into a generic web control, introducing:

WebValidationControlExtender

Here is an example of the control in design mode:

Here is an example of the control in action using an ObjectDataSource and a plain old DetailsView:

Here's what's going on under the hood.

All you need to do is tell WebValidationControlExtender what ObjectDataSource to hook in to.
When the page is executing and the user tries to insert a record, the DetailsView control builds up an object and sends it into the ObjectDataSource.
WebValidationControlExtender is already listening for Insert and Update events, all it does is check if the object being passed through implements IDataErrorInfo.
If it does, WebValidationControlExtender interrogates the object's columns/properties for errors.
If errors are found, it adds CustomValidators back to the page then goes searching for controls that are using that object datasource (in this case the DetailsView).
When it finds the details view it searches for BoundFields that are bound to the properties with the error, then inserts the red * like in the picture above.

The point is, you could go an implement whatever validation library suites your needs, as long as the object implements IDataErrorInfo the validation works. I just don't understand why ASP.NET doesn't already use something like this, there are so many complicated implementations for validation, I hope this brings some fresh light.

Another SubText Blog

Brendan Kowitz — Sat, 09 Jun 2007 11:14:22 GMT

Yes, I'm one of the crowd now, all because my old host Jumba is turning off the last of their Windows boxes, and coincidentally, the one I was hosted on. This has happened previously when they shut down some legacy Windows servers and forced everyone on it to upgrade.

Since Jumba is now no longer offering HELM windows hosting they have recommended xHostSolutions who have pretty comparative deals to what I was previously on, only better. This now gives me access to an MS Sql Server database, so I thought I'd take the opportunity to install SubText.

I still think that Single User Blog is a great place to start when you want to start sinking your teeth into ASP.NET 2.0, its very easy to get your head around and start using all the cool features that ASP.NET has to offer. This is one thing, but I'm now itching to try something a little more feature rich such as SubText. I do admire what wordpress has achieved in the blogging world, but I just can't seem to stray away from .NET, and not to mention the fact that wordpress is written in PHP.

Stopping ASP.NET web.config inheritance

Brendan Kowitz — Wed, 16 May 2007 03:11:23 GMT

If you are only ever running one ASP.NET application on a website this is not an issue. However, if you are running a site which may have an application at the root and other separate applications running in sub or virtual directories, then Settings inheritance could be a problem.

You can read more about how config files get inherited on msdn but here's a tip for stopping settings in the root app from getting inherited. The <location> tag is the only tag I've come across which has the inheritInChildApplications attribute. So to target the main <system.web> just wrap it in the location tag as seen below.

<location path="." inheritInChildApplications="false">
<system.web>
 ...
</system.web>
</location>

Other Notes:
Although I think the inheritance is in general a good feature to have, especially for inheriting down things such as security settings. It can even support locking certain settings for child applications, but things can be problematic if the child application doesn't share the same libraries, modules, handlers, masterpages or themes.

Most collections in the web.config have the <remove> tag or <clear> tag to remove irrelevant modules or handlers in the child app. The problems I've found occur with settings relating to the <pages> tag, which most items in it don't support <remove>. This means if your child applications doesn't share or have the same registered controls, masterpages or themes then you are probably going to have issues or be forced to specify the settings on a per-page basis. This is where the inheritInChildApplications="false" really comes in handy.

A Free, FreeTextBox Alternative

Tue, 20 Feb 2007 23:57:36 GMT

I don't know why but FreeTextBox has just never cut it for me. It's wonderful and easy to install and it comes as a nice control in a .NET assembly. But it doesn't give you the nicest HTML back, in fact I'd go as far as to say, it mutates GOOD HTML you put in there yourself, this is bad. Luckily there are some other free alternatives such as TinyMCE, which is a nice little editor. The only catch is it's pure javascript and requires a little manual intervention to work with your serverside code.

On a side note: The guys over at CommunityServer probably saw this problem and thought; no matter which editor you pick someone was going to complain, so they implemented the editor control in a Provider model. Clever.

I'm not using CommunityServer so changing my little SUB editor still requires two lines of code change and a recompile, but the flavor of the week for me is Obout's HTML Editor. This little beauty is free for personal use, and commercial use requires only a small registration fee.

This editor not only gives better HTML then FTB but also has some cool things like a Built-in spell checker, quick-formatting and bunches of other little options.

UPDATE(29-Mar-07): I have now had a change to try out FCKEditor, and it does seem to work very smoothly. Also I did notice an option when using it under Mozilla to format 'span' tags rather then the out dated 'font' tags.

It also appears that Obout may have changed their policy since I've made this post because I can no longer see any indication that they want anyone to use the editor for free, they seem to now be pushing downloading it as part of their new suite. So in light of this, FCKEditor may be your best alternative.

Hello IronPython for ASP.NET

Sun, 04 Feb 2007 11:14:35 GMT

Although this is not new news (released November 2006 I think), I'd like to point out how cool having Python run ASP.NET is. I don't actually know how to program python...yet...but programming Python appears intuitive be nature.

To get an HelloWorld IronPython ASP.NET application running, it took me all of about 5 minutes, 3 to download and install the add-in, 1 to open Visual Studio, then another minute to type in some stuff and run it. Sweet. At this point the intellisense has nothing of your other standard languages like C#, but I'm sure that's coming.

One of the biggest issues I see with a a large number of languages is a good IDE. Not to say that Python doesn't already have a number of good IDEs, but, I haven't used an IDE yet that actually beats Visual Studio. So since IronPython can make the effort to actually integrate with Visual Studio and be compatible with all my existing .NET libraries, maybe I'll just have to make more of an effort to check it out.

Search Engine Optimization for .NET

Brendan Kowitz — Sat, 16 Dec 2006 15:42:36 GMT

Search Engine Bot Detection

So after I first noticed a large build up of strange session Urls in Google searches for my domain I've then done a little bit of research into the issue and discovered it was .NET not detecting that the search engine spider was Mozilla/5.0 compliant and inserting some rubbish session id into the url.

It's been nearly a week since my changes to correct this and there's already a small indication of the 'healing' process. The pages are not out of the index yet, (and yes I do know that I 'could' remove them manually) but there are a lot of urls, and I'm in no rush.

Note on Webparts

Another change I have made this week was completing stripping webparts out of my template. Now even though I think webparts are extremely cool...they render HTML Soup. So I'd probably recommend that if you have a site where you are trying to get it to rank via the content, don't use webparts. If its an admin section / personalisation portal / intranet site or any other scenario when content ranking is not important, then by all means, feel the ~~soup~~ power!

Apart from dropping 20k from my page here's another unexpected result:

Yey I pass validation on W3C!!

Evil ViewState

Well I think viewstate is fantastic, its a set-and-forget automagic keep-state for all things on your form. Only problem is it renders before the content. This is a bad thing because search phrases gain more significance the closer they are to the top of the document, so the idea is to keep the soup at the bottom. A bit of Googling shows there are various methods that have been implemented to move it to the bottom. The method I kind of agreed with (although I've lost the link d'oh) was where a basepage class simple overrides handling the viewstate and uses the LosFormatter to store it in the session. Now I only half agree with this, I like the idea of overriding the handling of the viewstate but not putting it in the session. I simply used this but added my own HiddenControl (i.e. __VIEWSTATE_SEO) to the bottom of the form on pre-render, easy.

New Blog Category

In respect of all these new things that appear to be common SEO problems I have created to new category for SEO.NET (Search Engine Optimisation for .NET) blog posts. And in addition to this I will be trying to starting a small toolkit of classes and resources that should be able to be applied to any ASP.NET 2.0 application to make it more SEO friendly.

Download

Move ViewState to the bottom of the form BasePage.cs or view Source online

ASP.NET 2.0 Mozilla Browser Detection Hole

Brendan Kowitz — Mon, 11 Dec 2006 02:58:54 GMT

It has recently come to my attention that there is something drastically wrong with the way search engines have been indexing my ASP.NET 2.0 blog.

As I've started to explain previously, this is because of the way the browser detection is set up. To give a brief rundown ASP.NET 2.0 has a default browser definition which seems to assume that the default browser is fairly capable and supports common things such as javascript and cookies. A browser definition can get inherited into other definitions which can then override specific properties to update it for that specific browser or browser version.

Apparently in around March 2006 Google started rolling out updates that changed the Googlebot's useragent string from:

"Googlebot/2.1 (+http://www.googlebot.com/bot.html)" to
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

Now the reason for this is so the Googlebot could identify itself as being Mozilla/5.0 compliant which should allow it to be accepted by more webservers. However this breaks the detection pattern in ASP.NET. (And was always broken in Yahoo Slurp, I just don't know if anyone ever noticed).

When the useragent was just "Googlebot/2.1" it wasn't able to be matched and used the "default.browser" detection file which defaulted to a browser of reasonable capabilities. After the change it found itself in the "mozilla.browser" file because it was detected on the "Mozilla" word. So all the following sets of instructions in the "mozilla.browser" file try to establish exactly what platform and variant of Mozilla it is, for example, if its Firefox running on OSX, or if it's the older Mozilla Gecko rendering engine. But because there is no definition for a Generic Mozilla/5.0 compatible browser it gets the most relevant match, being the lowest Mozilla/1.0 compatible settings. Bad!

Because of this bad detection the default Mozilla/1.0 settings assume NO COOKIES and insert the session ID into the url then issues a response status 302 (content temporarily moved). What makes this situation even worse is that the default behavior of search engines is to follow these redirects and index the content on the other side. So basically everytime some random User-agent that claims to be Mozilla/5.0 compliant hits the site it gets Mozilla/1.0 capabilities. What is needed is something to bridge this gap.

Fortunately there is something that can be done that won't even require a recompile of your ASP.NET 2.0 application. Simply create a "genericmozilla5.browser" file in your "/App_Browsers" folder in the root of your application with the following in contents:

<browsers>
<browser id="GenericMozilla5" parentID="Mozilla">
<identification>
<userAgent match="Mozilla/5\.(?'minor'\d+).*[C|c]ompatible; ?(?'browser'.+); ?\+?(http://.+)\)" />
</identification>
<capabilities>
<capability name="majorversion" value="5" />
<capability name="minorversion" value="${minor}" />
<capability name="browser" value="${browser}" />
<capability name="Version" value="5.${minor}" />
<capability name="activexcontrols" value="true" />
<capability name="backgroundsounds" value="true" />
<capability name="cookies" value="true" />
<capability name="css1" value="true" />
<capability name="css2" value="true" />
<capability name="ecmascriptversion" value="1.2" />
<capability name="frames" value="true" />
<capability name="javaapplets" value="true" />
<capability name="javascript" value="true" />
<capability name="jscriptversion" value="5.0" />
<capability name="supportsCallback" value="true" />
<capability name="supportsFileUpload" value="true" />
<capability name="supportsMultilineTextBoxDisplay" value="true" />
<capability name="supportsMaintainScrollPositionOnPostback" value="true" />
<capability name="supportsVCard" value="true" />
<capability name="supportsXmlHttp" value="true" />
<capability name="tables" value="true" />
<capability name="vbscript" value="true" />
<capability name="w3cdomversion" value="1.0" />
<capability name="xml" value="true" />
<capability name="tagwriter" value="System.Web.UI.HtmlTextWriter" />
</capabilities>
</browser>
</browsers>

This will match generic Mozilla compatible browsers and spiders with user-agents strings such as:

Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Mozilla/5.0 (compatible; AbiLogicBot/1.0; +http://www.abilogic.com/bot.html)
Mozilla/5.0 (compatible; AnyApexBot/1.0; +http://www.anyapex.com/bot.html)
Mozilla/5.0 (compatible; BecomeBot/3.0; MSIE 6.0 compatible; +http://www.become.com/site_owners.html)
Mozilla/5.0 (compatible; MojeekBot/2.0; http://www.mojeek.com/bot.html)
Mozilla/5.0 (compatible; Scrubby/2.2; +http://www.scrubtheweb.com/)

Other Notes

The MSNBOT also never had this problem because it like the original Googlebot string was never detected and thus received the "default.browser" file settings which support the cookies.

My solution is not a complete fix, I think Microsoft could have done one thing better here. Because the browser string goes into the "mozilla.browser" file, they need another level where when it knows its Mozilla/5.0 compliant it gets the appropriate defaults before it starts to figure out exactly what browser it is. Even though with this approach the exact browsing useragent wouldn't be established, it would at least support future browsers claiming to be compliant at a higher level then just "Mozilla".

Downloads

genericmozilla5.browser