<%@ Page Title="Server-Side Validation (VB.NET)" Language="VB" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %>
<script runat="server">
    Protected Sub Uploader1_FileValidating(ByVal sender As Object, ByVal e As AjaxUploader.Events.FileValidatingEventArgs)
        ' Server-side gate: runs on the postback BEFORE FileUploaded. Cancelled
        ' files never reach your save logic. Client checks are convenience;
        ' this is the enforcement.
        Dim fileName As String = If(e.FileName, "(unnamed)")

        If e.FileSize <= 0 Then
            e.Cancel = True
            e.CancelReason = "Empty files are not allowed."
        ElseIf fileName.IndexOf("..", StringComparison.Ordinal) >= 0 Then
            e.Cancel = True
            e.CancelReason = "Relative path segments are not allowed."
        ElseIf String.Equals(System.IO.Path.GetExtension(fileName), ".tmp", StringComparison.OrdinalIgnoreCase) Then
            e.Cancel = True
            e.CancelReason = ".tmp files are blocked by server policy."
        End If

        If e.Cancel Then
            litLog.Text &= "<li class='text-danger'>REJECTED: <code>" & Server.HtmlEncode(fileName) &
                "</code> - " & Server.HtmlEncode(If(e.CancelReason, "policy")) & "</li>"
        Else
            litLog.Text &= "<li class='text-success'>accepted: <code>" & Server.HtmlEncode(fileName) & "</code></li>"
        End If
    End Sub

    Protected Sub Uploader1_FileUploaded(ByVal sender As Object, ByVal e As AjaxUploader.Events.FileUploadedEventArgs)
        Dim svc As New AjaxUploader.Services.UploadService()
        svc.CopyFile(e.FileGuid, "~/uploads/" & Guid.NewGuid().ToString("N") &
            System.IO.Path.GetExtension(If(e.FileName, "")))
    End Sub
</script>
<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Server-Side Validation (VB.NET) - AjaxUploader v5.3 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Server-Side Validation - VB.NET</asp:Content>
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server">
<div class="demo-card"> <div class="demo-card-header">The enforcement layer, in VB.NET</div> <div class="demo-card-body">
 <p class="demo-description"> <code>FileValidating</code> runs server-side on the postback, before <code>FileUploaded</code>.
 Set <code>e.Cancel = True</code> and the file never reaches your save logic - regardless of what
 the client claimed. </p>
 <div class="demo-expect"><strong>What you should see:</strong> normal files are accepted and saved; an empty file or a <code>.tmp</code> file is listed as REJECTED with the reason, and no save occurs for it.</div>
 <au:AjaxFileUpload ID="Uploader1" runat="server"
     AllowMultiple="true"
     AutoUpload="true"
     AutoPostBack="true"
     ShowProgress="true"
     OnFileValidating="Uploader1_FileValidating"
     OnFileUploaded="Uploader1_FileUploaded" />
 <ul class="small mt-3"><asp:Literal ID="litLog" runat="server" /></ul>
 <div class="code-panel"> <pre><code>Protected Sub Uploader1_FileValidating(ByVal sender As Object,
        ByVal e As AjaxUploader.Events.FileValidatingEventArgs)
    If e.FileSize <= 0 Then
        e.Cancel = True
        e.CancelReason = "Empty files are not allowed."
    ElseIf String.Equals(System.IO.Path.GetExtension(If(e.FileName, "")),
            ".tmp", StringComparison.OrdinalIgnoreCase) Then
        e.Cancel = True
        e.CancelReason = ".tmp files are blocked by server policy."
    End If
End Sub</code></pre> </div>
</div> </div>
</asp:Content>
