asp.mvc 4 EF ActionResult Edit with not all fields in view - asp.net-mvc

Question

The standard generated code bock for responding to the Edit save form
[HttpPost]
public ActionResult Edit(User user)
{
if (ModelState.IsValid)
{
db.Entry(user).State = EntityState.Modified;
db.SaveChanges();
return RedirectToAction("Index");
}
return View(user);
}
works when all fields are present in the edit view.
In my model I have a password field that (for obvious reasons) I don't want to pass as an invisible form field.
As a result password is null (which is to be expected).
How should I code to handle this scenario?
get the password value, should I fetch the value from the database?
if I use: User u = db.User.Find(user.ID); EF has issues with "an object with the same key already exists in the ObjectStateManager"
how do I tackle the ModelState.IsValid as it is false
I have found answers for previous mvc versions, but was wondering what is the most elegant / efficient way of achieving this?
#freeride, surly I don't have to test if user.Password is null, I expect it to be null and if it isn't then it was injected by a malicious user. The entire excersie was to avoid user manipulation of the password.
Removing the password field (ModelState.Remove("Password");) does solve the ModelState validation issue.
Now remains the question, how do I restore the password value? Following works:
[HttpPost]
public ActionResult Edit(user user)
{
user v = db.Users.Find(user.ID);
ModelState.Remove("Pass");
user.Password = v.Password; // assign from db
if (ModelState.IsValid)
{
//db.Entry(user).State = EntityState.Modified; // this won't work as the context changed
db.Entry(v).CurrentValues.SetValues(user); // we need to use this now
db.SaveChanges();
return RedirectToAction("Index");
}
return View(user);
}
I wonder if I'm obliged to do an extra db trip to fetch the value? I had to change the code to fix the EF context change, it works, but is the code right?

Answer 1

Before
if (ModelState.IsValid)
add
if (string.IsNullOrEmpty(user.Password))
{
ModelState.Remove("Password");
}
I wonder if I'm obliged to do an extra db trip to fetch the value? I
had to change the code to fix the EF context change, it works, but is
the code right?
Do it in a different way. Don't use an entity object as your model.
Create a model which contains only data you need to update,for example:
public class UserModel
{
public int Id { get; set; }
public string FirstName { get; set; }
public string Surname { get; set; }
}
and now:
[HttpPost]
public ActionResult Edit(UserModel userModel)
{
if (ModelState.IsValid)
{
User user = db.Users.Find(userModel.Id);
user.FirstName = userModel.FirstName ;
user.Surname = userModel.Surname;
db.SaveChanges();
return RedirectToAction("Index");
}
return View(userModel);
}
I hope it helps.