Skip to content

Inline AJAX grid edit via DataHelper.aspx

This workflow performs an inline mutation on a maintenance grid (e.g., an attorney table) by posting directly to DataHelper.aspx, bypassing the shared page ancestor and its authorization checks.

Field Value
Operation ID OP-APP-005
Trigger A grid on a maintenance screen issues an AJAX POST to DataHelper.aspx
Libraries involved SAIF.Application.Claim.Legal
Screens Attorney table grids on maintenance screens (e.g., Attorney Profile)
Inputs Client-supplied ViewID, grid mutation payload
Outputs Direct mutation of Oracle attorney tables

Steps

  1. A grid on a maintenance screen (e.g., attorney table) issues an AJAX POST to DataHelper.aspx, bypassing the normal page ancestor/master-page pipeline.
  2. DataHelper.aspx directly invokes clsAttorneyTableManager.ProcessAjaxRequest (SAIF.Application.Claim.Legal) with a client-supplied ViewID, with no authorization check and an empty catch around the operation (BR-APP-001).
  3. The manager performs the requested mutation directly against Oracle attorney tables, and any exception is silently swallowed, hiding both authorization gaps and data errors from the caller.

Process flow

The following diagram visualizes the inline AJAX grid edit workflow and its lack of authorization gating.

flowchart TD
    Start([Grid issues AJAX POST]) --> S1["DataHelper.aspx invokes<br>clsAttorneyTableManager.ProcessAjaxRequest"]
    S1 --> S2{Authorization check present?}
    S2 -->|No| S3["Mutation performed directly<br>against Oracle attorney<br>tables"]
    S3 --> S4{Exception occurs?}
    S4 -->|Yes| S5["Exception silently swallowed<br>by empty catch"]
    S4 -->|No| EndOk([Mutation succeeds])
    S5 --> EndSilent([Caller sees no error])

Failure and edge-case behavior

  • A user in the LNView (view-only) group can still mutate data through this path if the manager does not independently re-check authorization, because no IsInViewOnly/IsViewOnly/resource check exists on this endpoint.
  • Any exception raised during the mutation is silently swallowed by an empty catch block, hiding both authorization gaps and data errors from the caller.

Sources

  • LegalMaintenance web application (LegalMaintenance/*.aspx.vb)
  • LegalMaintenance web application (LegalMaintenance/*.aspx.vb)