ASP.NET 排除视图受到攻击
我有一个场景，我将两个视图合并为一个共享视图。
从项目中排除，但始终受到打击
- View/Foo/Do.aspx
- Views/Bar/Do.aspx
存在于项目中，但从未受到打击
- View/Shared/Do.aspx
文件仍然存在于源代码管理中，但它们不再是该项目。
为什么不再属于项目一部分的视图优先于属于项目的视图？也许我认为 MVC 所做的事情比它所做的更多...
MVC 是否只是查找它可以找到的任何匹配的文件，无论它是项目的一部分吗？
如果您可以使用正确的名称将文件放入其中，即使它不是项目的一部分，这是否是一个潜在的安全缺陷？
I have a scenario where I combined two Views into one shared View.
Excluded From Project but always gets hit
- Views/Foo/Do.aspx
- Views/Bar/Do.aspx
Exists in Project but never gets hit
- Views/Shared/Do.aspx
The files still exist in source control but they are no longer a part of the project.
Why would a View that is no longer a part of the project have precedence over a View that is a part of the project? Maybe I'm thinking MVC is doing more that it does...
Does MVC just look for any file that it can find that matches regardless of it being a part of the Project?
Is this a potential security flaw if you could drop a file in there with the proper name even though it's not a part of the Project?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
答案2是正确的。 MVC 将在视图文件夹中搜索匹配的命名视图。优先级是更具体的覆盖更一般的情况（即从控制器“Foo”调用的“Do”视图将首先查找Views/Foo/Do.aspx，然后查找Views/Shared/Do.aspx）。对于部分文件也是如此，只不过层次结构优先级首先按扩展名 (ascx)，然后按文件夹的特殊性。
成为项目的一部分只会影响 Visual Studio（“转到查看”、发布属性等工具）。尽管如果您选择编译视图，那么它可能会有所不同。
如果您允许人们将文件放入您的“视图”文件夹中，这只是一个安全缺陷，在这种情况下，他们可能会覆盖您项目中包含的任何视图。
Answer 2 is correct. MVC will search the view folders for a matching named view. Precedence is on a case of more-specific overrides more general (ie the "Do" view called from controller "Foo" will first look for Views/Foo/Do.aspx then look for Views/Shared/Do.aspx). The same is true for partials except the heirarchy prioritises first by extension (ascx) then by the specificity of the folder.
Being part of a project only affects Visual Studio (the tooling such as "go to view", publishing properties etc). Although if you choose to have compiled views then it may make a difference.
It is only a security flaw if you allow people to just drop files into your View folders, in which case they could just overwrite any of the views you had included in your project anyway.