www.superedge.net

How To Disable SharePoint Designer on SharePoint 2010 Programmatically

How to Populate a ObjectDataSource from a Dataset

How to increase SharePoint performance. Use of retail and debug modes.

How to list all the sites for a sharepoint web application using powershell script ?

How to Customize My Links Control in SharePoint

Workaround for Aptimize bug and list access denied in SharePoint

How to create your own SharePoint HttpContext

How to Fix SharePoint MySite Auto-Creation Errors During Self Service ?

How to get connection string from BDC and use ADO.NET in your queries ?

bicycle rides in 2010

SharePoint Resources

Disabling workspace meeting creation from SharePoint Calendar

How to programmatically configure RSS feed for a list in SharePoint

Versioning Settings and Picture Libraries Issues

How to Modify SharePoint List RSS Settings Programmatically

How to apply custom permissions to a list in SharePoint

Funny Error Messages in SharePoint Designer

How To Recycle IIS Application Pool Manually via DOS Command ?

Sharepoint Tips and How Tos

How to do Site Branding in SharePoint?

How to Design a SharePoint Application to the Cloud

How to Perform Sharepoint Deployment by Features

How to display Asp.Net error messages instead of the default SharePoint error messages on a website?

SQL Server 2005 queries running slower then SQL Server 2000

Why adding more memory won't fix your Out of Memory error ?

What Do You Do After Speaking To a Customer?

Why hiding my wireless Internet SSID will not make my connection safer ?

The Economics of Software Performance

The Perfect Entity Model Development Framework

How to setup Sharepoint sites for HTTPS

Filling the SOA gaps

New home

File Upload and Canonical Issues

Uploading files and bubbling events

Old Memories, Hard Disk

The Hot Side of the Dark Side of the Force

Stored procedure takes longer run SQL2005 than 2000

TeamSystem and TFS add-on to Count Lines of Code and Predict Errors

How to Make Productive Project Meetings

A safer code

Fix Visual Studio 2005 Slow Start

Even God reach out to the Audacious

What is Marketing ?

August

2010-04-30T12:05:00.000+10:00

2010-04-30T11:56:00.001+10:00

Here's a little PowerShell script to disable users from using SharePoint Designer 2007 on your SharePoint 2010 sites. It is not really a complicated matter like it was during the SharePoint 2007; the only thing to note here are 3 main points:

you must have access to the namespace Microsoft.SharePoint.Client
you MUST run this script with at least Admin permissions for the Site Collection in question
The functionality to enable and disable this must have been set during the site collection creation. By default it is NOT. You can check that on the Site Collection properties.

Failing to attend these 2 conditions will throw you back an exception.

function Lock-SharePoint-Designer-Use([string]$url)
{
    [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") > $null
    [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client") > $null
    $rootSite = new-object Microsoft.SharePoint.SPSite($url)
 
    if($rootSite.RootWeb.AllowDesignerForCurrentUser -eq "true")
    {
        $rootSite.AllowDesigner = false
        write-output "site "$($rootSite.RootWeb.Title)) "locked for SharePoint designer"
    }
    else
    {
        write-output "site "$($rootSite.RootWeb.Title)) "does not allow designer to be configured for this site collection"
    }
 
}

Additionally you can also try other configurations to increase the lockdown surface for nasty actions that can be accomplished by some users, such as :

$rootSite.AllowRevertFromTemplate

$rootSite.AllowMasterPageEditing

$rootSite.AllowShowUrlStructure

See you later,

-Edge

2010-04-29T12:30:00.001+10:00

To use datasets for data manipulation and grid displaying is great in a SharePoint environment.

The .NET framework offers many displaying controls for that task amongst them is the SPGridView. Grid views are excellent for presenting data because people like to see things organized in grids. it is almost natural to our eyes and project stakeholders love grids because they are like the heart and soul of a project management report.

If you are using SharePoint it is pretty straightforward to instantiate a SPGridView control and then use the datasource property to point to a dataset.

So let's say, you want to display all the team sites or site under a specific URL. you can populate a dataset with the rows and bind to the grid.

The only issue here is the network traffic. Every time you perform a postback you will force the dataset to be loaded and then the grid will just change the page displayed, but under the hood the whole dataset was there populated. If you have hundreds of sites and these are being accessed by multiple users it can potentially be using unnecessary bandwidth. ( note: There are strategies to place around this mechanism like using cache objects and persisting information in the viewstate, but we wont be discussing them here )

Would not be great if we could have a out-of-the-box structure good enough to allow fetching the necessary records for a specific page?

For that we can use the ObjectDataSource control.

You can read a lot about the usages of the ObjectDataSource all over the net, but if you are like me a big fan of datasets and you have been dealign with datasets objects in many legacy applications, you want to just want to have an easy way to migrate your datasets to ObjectDataSources.

Unfortunately, the ObjectDataSource control does not have a property like objectDataSource.DataSource neither it has a LoadFromXml or Load(Dataset)...

So how do you do?

Here's how I find it: using reflection.

ObjectDataSources do not have a property to perform something like MyObjectDataSource.DataSource=MyDataSet, but it does have a constructor that allows you to parse classes and extract data methods.

So let's say you have a scenario like this in a webpart

        /// <summary>
        /// Called by the ASP.NET page framework to notify server controls that use 
        /// composition-based implementation to create any child controls 
        /// they contain in preparation for posting back or rendering.
        /// </summary>
        protected override void CreateChildControls()
        {
            base.CreateChildControls();
            Grid = new SPGridView
                           {
                               AutoGenerateColumns = false,
                               AllowSorting = true,
                               AllowPaging = true,
                               AllowFiltering = true,
                               PageSize = 10
                           };
 
            Grid.DataSource = MyDataSet.MyTable;
            Grid.DataBind();
        }

To convert this to an ObjectDataSource you then do this...

        /// <summary>
        /// Gets the data table for object source.
        /// </summary>
        /// <returns></returns>
        public DataSet GetDataTableForObjectSource()
        {
            // do whatever you want to do here and 
            // return the table with the data
            return MyDataSet.MyTable;
        }
 
 
        /// <summary>
        /// Called by the ASP.NET page framework to notify server controls that use 
        /// composition-based implementation to create any child controls 
        /// they contain in preparation for posting back or rendering.
        /// </summary>
        protected override void CreateChildControls()
        {
            base.CreateChildControls();
 
            // in this constructor specify the type name, the class name and 
            // the public method inside this class where the object datasource will retrieve the data
            // make it a signed assembly for security reasons.
            var edgeDataSource =
                new ObjectDataSource(
                    "MyNamespace.MyClass, MyNamespace.MyClasss, Version=1.0.0.0, Culture=neutral, PublicKeyToken=ce8ab85a8f42a5e8",
                    "GetDataTableForObjectSource") {ID = "EdgeDataSource"};
 
            Grid = new SPGridView
                           {
                               AutoGenerateColumns = false,
                               AllowSorting = true,
                               AllowPaging = true,
                               AllowFiltering = true,
                               PageSize = 10
                           };
 
            // do not use DataSource property. MUST USE DataSourceID with the control name
            Grid.DataSourceID = "EdgeDataSource";
 
            // do this before the databind
            Controls.Add(edgeDataSource);
            Controls.Add(Grid);
 
            // bind the objects and execute the call 
            //specified in the ObjectDataSource constructor
            Grid.DataBind();
        }
 

Cute trick!

So there you go. To migrate, load, or populate ObjectDataSources using DataSets, all you have to do is to wrap the data returned in a public class and pass the method information to the ObjectDataSource constructor. I hope this helps you guys out there using ObjectDataSources.

Now go coding. Happy paging, happy filtering, happy caching!

See you later

-Edge

2010-04-19T13:07:00.001+10:00

...when was the last time you checked your machine.config for retail="true" ?

I've heard a few times that SharePoint is a beast, a heavy monster, or is too slow, or is too boring. Truth is not many people out there are following SharePoint best practices. Just to mention one: when deploying a SharePoint solution many people overlook a simple switch that can make a huge difference and and have serious implications when we are talking about performance: The debug switch.

Maybe because it is too simple find in the web.config, maybe because it is too easy to change using notepad... the truth is: a lot of extra plumbing work is done when an application in debug mode is released to your users.

Scenario: we have a SharePoint page that has a delegate control. that delegate control loads a custom ascx that's deployed as a feature. that control might popup in many places across the whole portal.

What happens when your web.config has debug=false ?
For starters, let's take a look at the size of the generated assemblies, the number of handles created in the system and the internals of the asp.net DLL compilation.

When your SharePoint DLLs are compiled and deployed with the debug mode switch turned to false, the first thing you will notice is the assembly files. Look their sizes. They are determined by the compilation switch, not by the web.config switch. For comparison purposes I will use assemblies compiled in release mode against assemblies compiled in debug mode.

When your SharePoint web.config application has the web config debug = false SharePoint, or more precisely the .net framework, will handle the assembly reference this way:

When the user makes the very first request to a page that contains that ascx, the framework will compile that ascx into a temporary DLL. That DLL will receive a random name and it will not contain the code-behind that might be present in the GAC. The framework will also create a shadow copy of that DLL and both copies will be placed in the ASP.NET temporary folder. That reference will be returned to that page and the page will be rendered to the user.

If you get to inspect the content of one of these files you will that that a kind of 'proxy' will be generated for them with all the references for the real control stored in the 12 hive. That's generated when the first call is made to the control.

contents of the file myapps.aspx.d7b311e5_CBMResult.compiled

<?xml version="1.0" encoding="utf-8"?>

<preserve resultType="7" virtualPath="/MySharepointApp.Personalisation.MyApps/12/TEMPLATE/LAYOUTS/MySharepointApp/MyApps.aspx"

hash="fffffff6f2b2ee5f" filehash="fffffff6c7a1c8b7"

flags="100000"

CCUpreservationFileName="myapps.aspx.d7b311e5_CBMResult.ccu">

</filedeps>

</preserve>

For all the subsequent requests from other pages using that same control, the same reference will be retrieved. It means the page will apply less pressure in the server and naturally the application will perform close to its best.

Now let's navigate the site opening more pages and see what's happening in the system. The number of handles keeps a steady balance.

Now let's observe what happens if we do the same process and leave the web.config debug=true and we deploy the DLLs compiled in debug mode.

First thing we will notice is an increase in the assembly file, because the symbols added to the assembly.

It is not much of a difference, just 1-5 KB here and there.

so we are led to believe it will not increase the footprint on the system, right? Yeah.. but no...but yeah; that's not the problem, the problem will reveal itself when we inspect the page lifecycle...That's what's going to happen in this scenario.

For every single call to the page using the control, a brand new temporary DLL will be generated and that's my friend... is a problem. You can not afford to have a portal with, let's say, 500 pages and do not suffer from (the lack of) performance management there with every single one of these assemblies loaded. See the overhead placed in the temp folder, see the overhead placed in the SharePoint portal handler...

Let's repeat the same process as case 1 and let's open another page that uses the same control. Look at the handlers in the system. They had a significantly increase. Now imagine that with hundreds of users.

That's going to be a lot of work for the garbage collector that should not be there if the person only took time to apply some basic best practices when deploying solutions. And the garbage collection is as we know a very expensive operation to be carried (probably) that often.

What should we do then?

Avoid debug=true in production environment. User Retail=true. Maybe you can't avoid people going there to the web.config and changing the settings to debug=true and false, but you can reduce the surface for problems. And one of the very first things you apply in production is the not so much talked about: retail mode.

    <system.web>
      <deployment retail="true" />
    </system.web>

The retail mode is a switch in the machine.config that automatically:

ignores all the debug=true switches and force them to be false.
disable the trace output in the pages
disable the custom errors configuration
disable the debug capabilities

In short: just flicking this switch you automatically reduces the surface for performance issues and also some hacking attacks by not exposing unnecessary information on the screen in case of an application crash. And because machine.config is hierarchically higher that web.config it will take precedence over any web.config from other applications deployed to your server.

Now go there and take a look how is your retail mode set and maybe with just a little flick you can change the performance of a whole portal and offer a better experience to the users.

See you later,

-Edge

2010-04-13T17:54:00.001+10:00

Solution 1:

Here's an quick and very useful script often requested by admin guys that I'd like to share and hopefully it will be useful to someone as well: list all the sites for a SharePoint Url and its owners.

Made in PowerShell

function List-Sites([string]$url)
{
    [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") > $null
    [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Administration") > $null
    $rootSite = new-object Microsoft.SharePoint.SPSite($url)
    $webApp = $rootSite.WebApplication
    if($webApp.Sites.Count -gt 0)
    {
        write-output "site url`tlast date content modified`tsite owner`tsite name`tsite url`tsite template`tsite description"
        foreach ($site in $webApp.Sites)
        {
            $rootweb = $site.RootWeb
            $allwebtemplates=$rootweb.GetAvailableWebTemplates(1033)
 
            foreach($template in $allwebtemplates)
            {
                if ($template.ID -eq $rootweb.WebTemplateId)
                {
                    $templatename=$template.Title
                }
            }
 
            $lastUpdatedDate = Get-Date "1/1/2000 1:00 AM"
            foreach($web1 in $site.AllWebs)
            {
                foreach($list in $web1)
                {
                    if ($lastUpdatedDate -lt $list.LastItemModifiedDate)
                    {
                        $lastUpdatedDate=$list.LastItemModifiedDate
                    }
                }
            }
 
            $SiteAdmin = new-object Microsoft.SharePoint.Administration.SPSiteAdministration($rootweb.URL)
            write-output "$($site.Url)`t$($lastUpdatedDate)`t$($site.Owner.LoginName)`t$($rootWeb.PortalName) $($rootWeb.Title)`t$($site.PortalUrl)`t$($rootWeb.WebTemplate) ( $templatename )`t$($rootWeb.Description)"
 
            $SiteAdmin.Dispose()
            $rootweb.Dispose()
        }
    }
    $rootSite.Dispose()
}

There is also a reference for the object SPSiteAdministration just in case you want to output more information.

Execute this script in the Powershell command line in your server and the output will be something like this:

Solution 2:

Not really a good solution if you have several sites; but if you just want to quickly find out the templates of a specific site alternatively you can go to your root web site and add this to your query string: /_vti_bin/owssvr.dll?Cmd=GetProjSchema

this will display the ONET.XML for that site, and if you scroll down until the Configuration node you can get the template being used currently

The admin guys are happy, developers are happy... win-win :)

See you later,

-E

2010-04-08T15:08:00.001+10:00

User adoption is everything in a successful SharePoint implementation and one of the main things to attract users to use the site is by customizing the site according to their needs or a previous product. In a lot of cases this never gets 100% done and then one day when a power users is browsing the site he can see things like that: A reference to the Microsoft product inside their own organization.

My SharePoint Sites link being displayed in the client screen

The ideal situation is for a product to be vendor/technology agnostic. From the user's point of view, he doesn't care what is the framework or the company; he just want to have access to his tools.

So, how to customize that My Links control from SharePoint web sites?

Answer: We will create a SharePoint feature to place our own ASCX control in the page instead the default SharePoint OOTB control.

First let's inspect how is this control implemented. If you open the homepage using SharePoint Designer and search for that specific part of the code you will notice that control is a SharePoint DelegateControl.

A delegate control is one of the coolest aspects of the SharePoint ecosystem. This control has the ability to render any user custom ASP.NET controls inside SharePoint pages on the fly by just changing the ControlId.

If we come back to our case, what that line is doing is: at this exact position, render the control called 'GlobalSiteLink2'.

Now remember these functionality are available to the application by features. Let's go then and search for the key 'GlobalSiteLink2' in the TEMPLATE\FEATURES folder on the 12 hive.

You will discover that there is a feature called 'MySite' there which implements the actual control.

Open the file MySiteFeatureElements.xml and you will see this:

   1 <Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    2   <Control Id="GlobalSiteLink1" Sequence="100" ControlSrc="~/_controltemplates/mysitelink.ascx" />
    3   <Control Id="GlobalSiteLink2" Sequence="100" ControlSrc="~/_controltemplates/mylinks.ascx"/>
    4   <Control Id="ProfileRedirection" Sequence="100" ControlSrc="~/_controltemplates/mysiteredirection.ascx"/>
    5 </Elements>

there it is our control Id='GlobalSiteLink2' and its source is in a file called 'mylinks.ascx'.

Next step, we need to find out the mylinks.ascx control. For that you have to navigate to the user controls folder at the 12 hive ($\TEMPLATE\CONTROLTEMPLATES). There you will see all the user controls available to SharePoint. Let's have a look at the source code of this control.

Code Snippet
     <%@ Control className="MyLinksUserControl" Language="C#" Inherits="Microsoft.SharePoint.Portal.WebControls.MyLinksUserControl&#44;Microsoft.SharePoint.Portal, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<%@ Register Tagprefix="OSRVWC" Namespace="Microsoft.Office.Server.WebControls" Assembly="Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<%@ Register Tagprefix="SPSWC" Namespace="Microsoft.SharePoint.Portal.WebControls" Assembly="Microsoft.SharePoint.Portal, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<%@ Register Tagprefix="SharePoint" Namespace="Microsoft.SharePoint.WebControls" Assembly="Microsoft.SharePoint, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<table><tr> 
<td class="ms-globallinks"><SPSWC:MyLinksMenuControl id="MyLinksMenu" runat="server" /></td> 
<td class="ms-globallinks"><asp:Literal id="hlMySiteSpacer" runat="server" /></td> 
</tr></table> 
   

We now see that MyLinksMenu is an object of MyLinksMenuControl, and this class is defined inside Microsoft.SharePoint.Portal.WebControls.Dll

That's good news. We find a method called LoadMenuItems() that returns an array list of menu items.

Ok. At this point we have to question ourselves something very important: We should avoid as much as we can interfere during the natural course of SharePoint's behavior. Given that method call we assume that instead modifying it we should be able to configure that string somewhere in the configuration files and then LoadMenuItems() would just return the items with the new label. Would not be the easier and most logical way for Microsoft and everybody else to modify that value?

As much as this proposition might sound correct, unfortunately the answer is no. That string is hardcoded somewhere into the SharePoint source code as a resource file and embedded within the DLL. If you try to inspect that, here's what you get:

The funny thing is that many other areas and messages and labels across the whole SharePoint platform can be configured by updating the resource files, makes you wonder: "why they did not used the same approach here?"

So, how to fix that?

Using the same delegate control to render your control instead of the out of the box one; and to avoid breaking the natural SharePoint flow of things we are going to create a control inheriting from the OOTB SharePoint MyLinksMenuControl.

We should start by creating a solution that looks like this with WSPBuilder. We will mimic the complete structure for MyLinks.ascx's feature and give it another name.

Compile the solution for the very first time and then extract the public key token. Go to the folder where the DLL is located and execute this command.

Copy and paste the public key token displayed in the screen in our next step, into the ascx source code.

Now will create a similar ascx control just like the original one, but instead of using the webcontrols part we will be using our own MyCustomLinksMenu.ascx

Code Snippet
     <%@ Control className="MyLinksUserControl" Language="C#" Inherits="Microsoft.SharePoint.Portal.WebControls.MyLinksUserControl&#44;Microsoft.SharePoint.Portal, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<%@ Register Tagprefix="OSRVWC" Namespace="Microsoft.Office.Server.WebControls" Assembly="Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<%@ Register Tagprefix="SPSWC" Namespace="CustomizeMyLinks" Assembly="CustomizeMyLinks, Version=1.0.0.0, Culture=neutral, PublicKeyToken=995e4d025d306cec" %> 
<%@ Register Tagprefix="SharePoint" Namespace="Microsoft.SharePoint.WebControls" Assembly="Microsoft.SharePoint, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" %> 
<table><tr> 
<td class="ms-globallinks"><SPSWC:MyCustomLinksMenu id="MyLinksMenu" runat="server" /></td> 
<td class="ms-globallinks"><asp:Literal id="hlMySiteSpacer" runat="server" /></td> 
</tr></table> 
   

Let's go to www.newguid.net and get ourselves a brand new Guid for the feature. Keep this Guid, we will use it in our next step to assign it to the feature Id.

This is how it will looks like our new feature.XML.

    1 <?xml version="1.0" encoding="utf-8"?>
    2 <Feature Id="{6fed26c0-57d3-4237-afd7-722c5c13a147}"
    3         Title="Customize MyLinks menu control"
    4         Description="Renames the mention to SharePoint from the MyLinks control, to make the website more vendor agnostic"
    5         Version="1.0.0.0"
    6         Hidden="FALSE"
    7         Scope="Site"
    8         xmlns="http://schemas.microsoft.com/sharepoint/"
    9         ImageUrl ="">
   10   <ElementManifests>
   11     <ElementManifest Location="elements.xml"/>
   12   </ElementManifests>
   13 </Feature>

And this is our new elements.XML which is a copy from MySiteFeatureElements.XML. Note the control GlobalSiteLink2 pointing to our brand new ascx control.

    1 <Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    2   <Control Id="GlobalSiteLink1" Sequence="100" ControlSrc="~/_controltemplates/mysitelink.ascx" />
    3   <Control Id="GlobalSiteLink2" Sequence="100" ControlSrc="~/_controltemplates/MyCustomLinksMenu/MyCustomLinksMenu.ascx"/>
    4   <Control Id="ProfileRedirection" Sequence="100" ControlSrc="~/_controltemplates/mysiteredirection.ascx"/>
    5 </Elements>

And here's the code for the custom control. The comments in the code are self-explanatory.

    1 using System.Collections;
    2 using Microsoft.SharePoint.Portal.WebControls;
    3 using Microsoft.SharePoint.WebControls;
    4 
    5 namespace CustomizeMyLinks
    6 {
    7     /// <summary>
    8     /// Customize the current MyLinks menu control 
    9     /// and rename the link 'My SharePoint Sites' to 'Visit Your Sites'
   10     /// </summary>
   11     public class MyCustomLinksMenu : MyLinksMenuControl
   12     {
   13         /// <summary>
   14         /// Loads the menu items.
   15         /// </summary>
   16         /// <returns>a <see cref="ArrayList"/> with 
   17         /// all the menu items from <see cref="MyLinksMenuControl.LoadMenuItems"/></returns>
   18         protected override ArrayList LoadMenuItems()
   19         {
   20             // make sure you will call the out of the box method that generates
   21             // the default items in SharePoint
   22             var currentMenuItems = base.LoadMenuItems();
   23 
   24             if ((currentMenuItems != null) && (currentMenuItems.Count>0))
   25             {
   26                 // now that you have the items, you can manipulate them the way you want
   27                 SubMenuTemplate customMenuTemplate;
   28                 using (customMenuTemplate = (SubMenuTemplate) (currentMenuItems[0]))
   29                 {
   30                     if (customMenuTemplate != null)
   31                     {
   32                         customMenuTemplate.Text = "Visit Your Sites"; // or any other text you want here
   33                         currentMenuItems.RemoveAt(0);
   34                         currentMenuItems.Add(customMenuTemplate);
   35                         // you can also try currentMenuItems.InsertAt(0,customMenuTemplate);
   36                     }
   37                 }
   38             }
   39             return currentMenuItems;
   40         }
   41     }
   42 }

Compile. Build the package with WSPBuilder and deploy the feature to the 12 hive, activate the feature in the web site and voilá! You will see the link customized.

See you later

-E

2010-03-15T17:33:00.003+10:00

Update: It looks like this was a false positive. Yes, all the errors could be replicated by switching the Aptimize on and off but I could not reproduce this issue in a brand new environment which means, Aptimize might not be the problem here but other environmental issues.
As soon as I have more news/fix/info about it I will update this post. Thanks to all the Aptimize people for the contact and great support on this case.

If you are using a product called Aptimize for SharePoint you might have noticed that it is a great product when it comes to minimizing the footprint in the front end and reducing the rendered size of the output. Unfortunately with great power comes also some inconvenient bugs. Like the one below.

In our test scenario we will have a normal SharePoint document library...

...with versioning, content approval and major and minor versions enabled.

...Nothing unusual here. Very well.

Then we will have a custom SharePoint page with a custom webpart in it that does a simple thing: loop through the specified library and builds up a list of those items who are published or have a published version.

       private static void LoadFake(SPSite site, string virtualLibraryPath, IDictionary<string, bool> fake)
       {
           using (SPWeb web = site.OpenWeb(virtualLibraryPath))
           {
               SPList list = web.GetList(virtualLibraryPath);
               SPListItemCollection items = list.Items;
               foreach (SPListItem item in items)
               {
                   if(item.HasPublishedVersion)
                   {
                       // do anything here...
                   }
               }
           }
       }

The code above works EXCEPT if you have at least one item in that library in pending approval state AND you have APTIMIZE installed in the server; then you will see that SharePoint error.

error: access denied - current user - you are currently signed in as: xxx - sign in as a different user

If you go to the event viewer you will notice that Aptimize might be running with no problems at all.

Aptimize Website Accelerator initialized successfully.

Settings:
Enabled: True
RunMode: Development
AutoVersionUrls: True
UseAlternateAutoVersionUrlFormat: False
NewInstall: True
UseDefaultSystemProxy: False
MaxOptimizationsPerSecond: 50
CacheMaxMemory: 100
ResourceSetCacheMaxAge: 172800
PageSpriteCacheMaxAge: 28800
CachePath:
HandlerName: wax.axd
RunAsDaemon: False
VirtualRoot:
DefaultCharset:
PreviewMode: False
IncludeOriginalImageUrl: False
InlineCssImagesOnVista: True
ForceGzipOn: False
ForwardClientAddress: False
TrustedForwarders:
PageCachingEnabled: False
PageCachingVaryBy: Cookie
PageCachingVaryByParam:
IncludeFromDomains: ThisDomain
DiskCacheCleanupInterval: 60
MemoryCacheCleanupInterval: 1
ResourceClientCacheDuration: 259200
ResourceRecheckInterval: 60
PageClientCacheDuration: 30
PageRecheckInterval: 10
Action: Exclude
CombineStyleSheets: All
CombineImages: All
HttpCompression: Smallest
CombineBodyScripts: All
CombineHeadScripts: All
InlineCssImages: True
MaxInlineImageSize: 1200
BodyScriptInsertionPoint: BodyStart
HeadScriptInsertionPoint: BodyStart
AsyncScriptLoading: False
AsyncStyleSheetLoading: False
LogInfoLevel: Info
ProxyCacheable: False
ShrinkCss: True
ShrinkScripts: True
ShrinkImages: True
JpegQuality: 85
ConvertGifToPng: False
HttpFetchTimeout: 5000
EnableClientApi: False
SuppressedErrorCodes:
CacheableMimeTypes: text/css,text/javascript,application/x-javascript,image/gif,image/png,image/jpeg,image/jpg,image/bmp,image/x-icon,application/x-shockwave-flash
CompressableMimeTypes: text/html,application/xhtml+xml,text/css,text/javascript,application/x-javascript,text/xml,application/xml,application/json

But then a lit bit later you will see these two entries in the event log

Error initializing Safe control - Assembly:Mondosoft.Ontolica.SharePoint.Reporting, Version=3.0.0.0, Culture=neutral, PublicKeyToken=c7127db7656685c6 TypeName: Mondosoft.Ontolica.SharePoint.Reporting.WebControls.WebParts.ReportingWebPart Error: Could not load file or assembly 'Microsoft.ReportingServices.SharePoint.UI.WebParts, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91' or one of its dependencies. The system cannot find the file specified.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

The description for Event ID ( 8214 ) in Source ( Windows SharePoint Services 3 ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: A request was made for a URL, http://xx.xx.xx.xx, which has not been configured in Alternate Access Mappings. Some links may point to the Alternate Access URL for the default zone, http://www.www.ww. Review the Alternate Access mappings for this Web application at http://myserver:9100/_admin/AlternateUrlCollections.aspx and consider adding http://xxx.xxx.xxx.xx as a Public Alternate Access URL if it will be used frequently. Help on this error: http://go.microsoft.com/fwlink/?LinkId=114854

If you now go to the Aptimize console and turn off the website optimization, the error goes away.

The curious thing. if you debug that code above you will noticed that an exception will happen at line #9.

Apparently Aptimize is doing something under the hood that causes a privilege exception when calling SPListItem.HasPublishedVersion even if you are running as System Administrator and even if you are running using RunWithElevatedPrivileges method. Inspect the returned error and it will see an UnauthorizedAccessException.

The fix for now is to avoid calling HasPublishedVersion until we hear back from the Aptimize guys.

If someone out there seen the same issue and would like to share any ideas, feel free. Meanwhile I hope this workaround helps someone.

See you later

-Edge

2010-02-23T18:07:00.001+10:00

Quick and short. Here's a function that I use to create my own SharePoint HttpContext objects outside the SharePoint websites domain. I hope it is somehow useful to someone out there as well.

1 /// <summary>

2 /// Enables a share point call from anywhere by creating your own context.

3 /// </summary>

4 /// <param name="siteCollectionUrl">The site collection URL where you want to create the context.</param>

5 /// <example>

6 /// EnableSharePointCallByCreatingYourOwnContext("http://mysite.com.au");

7 /// </example>

8 private void EnableSharePointCallByCreatingYourOwnContext(string siteCollectionUrl)

9 {

10 using (var site = new SPSite(siteCollectionUrl))

11 {

12 using (var web = site.OpenWeb())

13 {

14 // assumes that context does not exists

15 var contextCreated = false;

17 // if it does not exists, then create it

18 if (HttpContext.Current == null)

19 {

20 contextCreated = true;

21 // creates a request object for the current web URL

22 var request = new HttpRequest(string.Empty, web.Url, string.Empty);

24 // open the pipe to output the http stream

25 HttpResponse httpResponse;

26 using (var responseWriter = new StringWriter())

27 {

28 httpResponse = new HttpResponse(responseWriter);

29 }

31 // creates the context

32 HttpContext.Current = new HttpContext(request, httpResponse);

34 // HttpHandlerSPWeb is a the property name where you must assign the current web

35 // in order to associate the newly created context to sharepoint

36 if (HttpContext.Current.Items != null)

37 {

38 HttpContext.Current.Items["HttpHandlerSPWeb"] = web;

39 }

40 }

42 // ...

43 // do whatever you want to do here

44 // ...

46 // return the application context to the original state prior the execution

47 if (contextCreated)

48 {

49 HttpContext.Current = null;

50 }

51 }

52 }

53 }

See you later

-Edge

2010-02-23T16:15:00.001+10:00

SharePoint MySites features is one of the best social features in the platform. It effectively gives to the end user control to his own area leveraging even more the collaboration capabilities of the enterprise.

One of these days we had a strange issue when creating my sites, which should be a trivial task. When an end user goes to his MySite link for the very first time the MySite creation can be automatically triggered, instead this error message was being displayed.

there has been an error creating the personal site. Contact your site administrator for more information.

With not so many clues to inspect this case we went to take a look at the event viewer to see what's going on.

When we saw this exception logged.

The site /personal/edge could not be created. The following exception occured: Failed to instantiate file "default.master" from module "DefaultMasterPage": Source path "default.master" not found. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

A little bit further, we see some more exceptions related to that previous entry where we can see a more detailed explanation for the error.

My Site creation failure for user 'CORP\edge' for site url 'http://my.portaldev/personal/edge. The exception was: Microsoft.Office.Server.UserProfiles.PersonalSiteCreateException: A failure was encountered while attempting to create the site. ---> Microsoft.SharePoint.SPException: Failed to instantiate file "default.master" from module "DefaultMasterPage": Source path "default.master" not found. ---> System.Runtime.InteropServices.COMException (0x81070587): Failed to instantiate file "default.master" from module "DefaultMasterPage": Source path "default.master" not found.
   at Microsoft.SharePoint.Library.SPRequestInternalClass.ApplyWebTemplate(String bstrUrl, String& bstrWebTemplate, Int32& plWebTemplateId)
   at Microsoft.SharePoint.Library.SPRequest.ApplyWebTemplate(String bstrUrl, String& bstrWebTemplate, Int32& plWebTemplateId)
   --- End of inner exception stack trace ---
   at Microsoft.SharePoint.Library.SPRequest.ApplyWebTemplate(String bstrUrl, String& bstrWebTemplate, Int32& plWebTemplateId)
   at Microsoft.SharePoint.SPWeb.ApplyWebTemplate(String strWebTemplate)
   at Microsoft.SharePoint.Administration.SPSiteCollection.Add(SPContentDatabase database, String siteUrl, String title, String description, UInt32 nLCID, String webTemplate, String ownerLogin, String ownerName, String ownerEmail, String secondaryContactLogin, String secondaryContactName, String secondaryContactEmail, String quotaTemplate, String sscRootWebUrl, Boolean useHostHeaderAsSiteName)
   at Microsoft.SharePoint.SPSite.SelfServiceCreateSite(String siteUrl, String title, String description, UInt32 nLCID, String webTemplate, String ownerLogin, String ownerName, String ownerEmail, String contactLogin, String contactName, String contactEmail, String quotaTemplate)
   at Microsoft.Office.Server.UserProfiles.UserProfile.<>c__DisplayClass2.<CreateSite>b__0()
   --- End of inner exception stack trace ---
   at Microsoft.Office.Server.UserProfiles.UserProfile.<>c__DisplayClass2.<CreateSite>b__0()
   at Microsoft.SharePoint.SPSecurity.CodeToRunElevatedWrapper(Object state)
   at Microsoft.SharePoint.SPSecurity.<>c__DisplayClass4.<RunWithElevatedPrivileges>b__2()
   at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
   at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param)
   at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
   at Microsoft.Office.Server.UserProfiles.UserProfile.CreateSite(String strRequestUrl, Boolean bCollision, Int32 lcid).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp

So there we go. There is a clue indicating the a file called default.master was not found where it was supposed to be. We step into the Microsoft.SharePoint.Library.SPRequest class to understand what the method ApplyWebTemplate does but not much can be told from there as we can see in the picture. Also there is another method call to a private member, and probably obfuscated by Microsoft, which we can not debug.

In these cases, there is a straight forward thing to do which is if possible, compare against a working version of SharePoint and see the differences. Luckily we had one and we noted that (for some reason) the files in the SPSPERS were missing in the 12 hive.

\XML\onet.xml
blog.xsl
default.aspx

We just put the files back in there and it is all good and back to normal. If you ever have this problem also pay special attention if you have done any modifications in these templates.

See you later,

-E

2010-02-23T12:57:00.001+10:00

The SharePoint BDC is great in a sense that once you target your data to be displayed, the end user can create and format many reports and data grids at his own convenience, however there is a price to pay for that: performance.

The operations executed via BDC can be extremely slow. Just so you know I will talk about a project I had to implement and how an alternative solution can be put in place to maximize the overall performance.

The task was to is to hit a specific database and bring a whole set of records in order to build a report. For many architectural reasons particular to the project, the BDC approach had to be used for the task.

The SharePoint web site makes the request to the BDC, the BDC then drags the data out of the external database and then this data is manipulated and displayed back in the end user report page. The transaction is much like the picture below:

In this specific case, the whole task takes approximately 6 minutes. Yeah, I know. Painful.

Let's run a profiler against that page and see what it tells about it. (I will blur all text which might contain sensitive information about the client.)

Well, once we have analyzed that data in our hands outlining all the calls being executed during this specific SharePoint's page life cycle and what's going on behind the scenes we can draw a few conclusions and the most important conclusion here is that 2 single calls are responsible for almost 99% of the total execution time. Now that an impressive bottleneck.

Let's dive a bit further on it into the internal calls and we can identify the very single calls responsible for these times.

When we go back to the source code to take a look at them, it turns out that they were the ones connecting and loading the data from the BDC.

The world would be perfect if we only could have done things our way, but unfortunately due to requirements restrictions this can not be changed.

As a good exercise I made myself a mirror copy of this environment to test a theory. What if we change the approach to loading data from the BDC?

The idea is to connect to the BDC and only extract the necessary connection string to the external data source and from there I would load the data via ADO.Net. That would be great because :

we are not performing any breaking changes in the current structure
the BDC still plays the game
All the permissions and security levels are still managed by the BDC definition
I have an opportunity to retrieve data from an external source much faster than via BDC

1 and 2 we would get the BDC connection string.
3 and 4 we will query the external database and get the data displayed on screen.

Using the properties in the code below you can get the properties returned from the BDC catalog and amongst them you can see the returned connection string with all the permissions etc for your use in your SharePoint code. Neat!

Note that the code is also using Entity Framework.

25 public static void SetSharedServiceProvider(SPSite site)

26 {

27 try

28 {

29 if (site != null)

30 {

32 SqlSessionProvider.Instance().SetThreadLocalSharedResourceProviderToUse(

33 ServerContext.GetContext(site));

34 }

35 }

37 catch (Exception)

38 {

39 // Ignore the exception if a provider

40 // is already set.

41 }

43 }

45 public static EntityConnection GetOnePortalConnectionString(SPSite site)

46 {

47 const string instanceName = "TEST_Instance";

48 SetSharedServiceProvider(site);

49 LobSystemInstance instance = ApplicationRegistry.GetLobSystemInstances()[instanceName];

50 var properties = instance.GetProperties();

53 return GetEntityConnection(GetProperty(properties, "CONN Data Source"),

54 GetProperty(properties, "CON Initial Catalog"));

55 }

Once implemented the results are impressive. The page that use to load in minutes now takes a couple of seconds to run.

Now moving from the current scenario to the improved version is easier said than done and the lesson learned here is that BDC can be as great as mush as it can be plain dangerous to kill an application.

See you later,

-E

2010-01-01T13:01:00.000+10:00

June

July

September

October

November

December

2009-10-30T16:34:00.000+10:00

SharePoint 2010

FAST Search Server 2010 trial - Microsoft FAST Search Server 2010 for SharePoint is a new search solution that delivers the power of FAST with the simplicity and TCO of Microsoft. It provides the best general productivity search on the market AND makes it easy and economical to build high-value search applications.
SharePoint 2010 Virtual Machine - This download contains a two Virtual Machine set for evaluating and demonstrating Office 2010 and SharePoint 2010. Additional training material can be found here and here. Here are resources for VS2010
SPG2010 Guidance – SharePoint Guidance drop notes
Technical Diagrams (posters) - these resources are visual representations of recommended solutions. include poster-sized documents available in formats including Microsoft Office Visio 2007 files (.vsd), PDF files, and XPS files
Evaluation Guide SP 2010 - This evaluation guide is designed to help IT pros gain sufficient knowledge and understanding to evaluate Microsoft SharePoint Server 2010
Broadcast PowerPoint on SharePoint 2010 - Guide to installing and configuring a solution for broadcasting Microsoft PowerPoint slide shows
Professional Developer Evaluation Guide - The SharePoint 2010 developer evaluation guide describes the SharePoint 2010 developer platform, including walkthroughs of some of the new capabilities for developers
SharePoint Developer Platform Wall Poster - The SharePoint 2010 Developer Platform wall poster shows a view of the SharePoint 2010 developer tools, community ecosystem, execution environment, Sharepoint Server 2010 workloads, and target application types. The poster is intended to be printed at 24 inches x 36 inches (61 centimeters x 91 centimeters)
Developer and IT Professional Learning Plan - A guide to learning about SharePoint 2010 for Developers and IT Pros
Getting Started with Development on SharePoint 2010 handson labs - Use these 10 hands-on lab manuals for SharePoint 2010 to get started learning SharePoint 2010 development

WSS

WSS Diagrams (posters) - These are visual representations of recommended solutions of WSS
ULS Viewer - Winforms application to display ULS messages
How to disable the Virtual PC image clock from the host server

SharePoint 2007

Technical Diagrams (posters) - poster-sized documents with visual representations of recommended solutions
Sharepoint Designer
Sharepoint Services 3.0 + Service Pack 1
Sharepoint Server 2007 (MOSS) Trial
Sharepoint Server 2007 Virtual Disk - This download comes as a pre-configured VHD. This download enables you evaluate Microsoft Office SharePoint Server 2007. Virtual Server 2005 R2 is required to run this VHD.
Sharepoint Services 3.0 Templates: All
Sharepoint 2007 SKD - The Microsoft Office SharePoint Server 2007 SDK contains conceptual overviews, “How Do I…?” programming tasks, developer tools, code samples, references, and an Enterprise Content Management (ECM) starter kit to guide you in developing solutions based on Microsoft Office SharePoint Server 2007
MOSS Service Pack 1
MOSS Virtual Disk - This download comes as a pre-configured VHD. This download enables you evaluate Microsoft Office SharePoint Server 2007
VisualStudio 2008 Extensions 1.3 (VSeWSS) - SharePoint project and item templates for Visual Studio 2008 - VSeWSS 1.3 (Feb 2009 CTP)
Accessibility Kit For Sharepoint - free downloadable kit that helps you to quickly implement WCAG 1.0 compliant sites
Sharepoint Guidance Kit - This guidance helps architects and developers design, build, test, deploy, and upgrade SharePoint intranet applications. A reference implementation demonstrates solutions to common architectural, development, and application lifecycle management challenges.
WSP Builder - A SharePoint Solution Package (WSP) creation tool for WSS 3.0 & MOSS 2007
STSDEV - A SharePoint developer's utility designed to quickly transform your ideas into real-world components that you can deploy into a staging or production Web farm with confidence.
Ten Themes for Sharepoint in VWeWSS - This is a set of ten Visual Studio 2008 extensions for SharePoint projects containing designed themes for SharePoint
Microsoft Web Platform Installer – One-click setup your whole development environment
Governance Check List for Sharepoint – A collection of hand-selected checklists and tips to provide comprehensive governance when implementing Sharepoint
Windows Sharepoint Services 3.0 SKD - The Windows SharePoint Services 3.0 software development kit (SDK) contains conceptual overviews, programming tasks, samples, and references to guide you in developing solutions based on Windows SharePoint Services 3.0
Managed Stack Explorer - if you want to troubleshoot hangs/performance issues in a process but don’t want to go through the hassle of getting and analyzing a dump. What it will do is basically attach, snap the .net call stack and detach so you can see what all the .net threads are doing without using a debugger.
SharePoint Productivity Hub – The Productivity Hub is a Microsoft SharePoint Server 2007 site collection that offers training materials for end-users.

2009-10-22T15:17:00.002+10:00

In many big implementations for SharePoint, TeamSites is a great tool for collaboration and for user-driven participation.
There is also another functionality in SharePoint called Workspaces, which is a small cut-down version of what a TeamSite can offer. Workspaces normally can be used to track meeting minutes, small task forces and general gatherings and its automatically creation is found inside the calendar items, which makes the creation so easy by the users. All they have to do is to flick the checkbox and click OK.

For the big enterprises, it does not make much sense to implement TeamSites and still have to manage Workspaces due to the similarities it had to Team Sites, and specially when it is so easy to create on a uncontrolled manner.

So what how to disable workspaces creation and avoid the meeting workspaces proliferation?

you can achieve this in many ways. I can tell you the most common use found on the Internet: the JavaScript solution.
It is very simple to implement. Basically you drop JavaScript in the page and the JavaScript will look for the html row that contains the workspace checkbox creation, then once found make it invisible. In fact the option is still there, the users just cant see it anymore.

From an implementation point of view, that's straight forward and many users of many levels can actually do this. From a governance and architectural point of view, that's not the best recommended:

it will introduce new code into SharePoint ecosystem, and potentially a new debug variable.
it does not scale well.
it is vulnerable to malicious code.
an advanced enough user can in fact bypass that barrier by cross-scripting himself that option to be visible again

The other approach would be to understand SharePoint and how it works internally. Always have in mind that SharePoint was not meant to be modified, but extended or configured. If you research enough might find that this setting can be controlled.

To remove the option to create workspaces in SharePoint, you need to go to:

...12 hive folder\TEMPLATE\FEATURES\EventsList\Events

Edit the file called schema.xml (I would recommend to make a backup copy, as well) and edit the field to be like that:

     <Field ID="{08fc65f9-48eb-4e99-bd61-5946c439e691}" 
            Type="CrossProjectLink" Name="WorkspaceLink" 
            Format="EventList" DisplayName="$Resources:core,Workspace;" 
            DisplayImage="mtgicon.gif" HeaderImage="mtgicnhd.gif" 
            ClassInfo="Icon" Title="$Resources:core,Meeting_Workspace;" 
            Filterable="TRUE" Sealed="TRUE" 
            SourceID="http://schemas.microsoft.com/sharepoint/v3" 
            StaticName="WorkspaceLink" 
            ShowInEditForm="FALSE" ShowInNewForm="FALSE">

the 2 new attributes ShowInEditForm and ShowInNewForm will control the workspace checkbox visibility.

Did you like that? :)

Update: Aapo from SharePoint Blues just mentioned another way to perform this operation. You should check that out.

-E

2009-10-20T14:55:00.001+10:00

Here's another interesting story. SharePoint will overwrite all the RSS columns you might have setup for a list.

One of the tasks I was working was to process across all the list in all the sites of a specific site collection, then enable RSS settings for each list and set a predefined group of columns as the RSS output. Once that's done, one could easily go to the list settings and verify them like the figure below:

The whole process executed with no problems. No error messages and no warnings.

However, when I went to take a look at my modified RSS settings that's the screen I saw:

It means, nothing was setup the way I planned. Apparently nothing happened when the code executed.

So I went to debug and inspected the line one by one. No error and when I went to see the screen, that's what I've got:

Yep. Everything was there and working.

How come it fails in first place and worked well on my second try?

This behavior continued on and on and and on, with many other libraries. Fails the first time, succeed in the second. So I went to look at the data definition using SharePoint Explorer. For a brand new library, that's what I saw:

And that's how it looks like once I execute my code to create a new RSS feed:

All right. It means the RSS is actually there. So I went to see the RSS settings in the page and guess what...That's what I see:

The RSS is blank again!!!

Then I came back to see using the explorer and...

Voila... something is kick-starting the creation of a brand new RSS setting and overwriting my one for usage.

I had a guess but it was just too weird to believe: SharePoint creates automatically a RSS feed for the first time and only during the first time an user visits the settings page.

I decided to debug the page and try to understand what SharePoint calls are made via UI. I've got my hands on the _layouts/listsyndication.aspx page from SharePoint

and I attached a debugger to it. I chose a brand new document library to test my theory and during the first page load I got this breakpoint:

During the page load there is javascript call to the server triggering SPList.EnsureRssSettings()

Then using .NET Reflector I opened the Microsoft.Sharepoint.Dll version 12 and found the method signature:

Looking inside the method I noticed:

SharePoint does use a hardcoded string ("RssView") to control the RSS name and which view is a RSS type.
EnsureRssSettings in fact creates a brand new Rss feed for you, without your request.

So, debriefing the case. When you open up the settings page, the listsyndication.aspx page automatically performs a call to SPList.EnsureRssSettings() which automatically creates a RSS feed (if syndication is enabled) and makes it invisible (see property Hidden=true). When my code ran, it created another view with the same name RssView, but actually the web address was different. The next time the code executed, I was not working anymore with my view but with the previously automatically created Rss from SharePoint.

Closing up the case: Next time you need to create a Rss feed, you don't have to create a view. You just have to make sure you call in your code SPList.EnableRssSettings() and then go ahead and modify the SPList.View called "RssView"

Now, the code:

and then to save the Rss feed...

See you later,

-Edge

2009-08-27T18:33:00.001+10:00

Can you imagine a news website without any sort of control for the pictures being uploaded to the front page?

Content types (CT) are a big part of any well-planned content management system. In our enterprise we have a dedicated content team who is in control of the CTs for the CMS. They are extremely good at what they do and they really have a good grasp about the business, its processes, documents and metadata. Unfortunately, to deal with legacy systems is the issue and our legacy issue is to unify all the websites and its lists with its correct content types.

Early this week I had to find a way to setup and modify the versioning settings for the lists of our sites. As we can see, this can easily be done via Site Settings option. The issue here is that we have hundreds of sites, not to mention all the Team Sites, across all the enterprise. And possibly thousands of libraries. Meaning: It is impracticable to do this via UI. So, programmatically was the choice.

And honestly, this choice did not look so hard… at first at least.

The SPList object model exposes to us all the properties necessary do control these options enumerated in the page (as we will see in our code later) but make no mistake, the solution is not as trivial as one might think. The biggest problem is here: Enable Content approval.

Let’s do a short parenthesis here and reflect about this matter, from the business point of view.

And that’s a vital piece of functionality. Imagine a news website, like www.CNN.com or www.BBC.co.uk, possibly with hundreds of employees/contractors working on the website content. They write news stories, upload pictures etc. As an editor, would you give them any level of access they want? Of course not. In the ideal model, we must have a group of people responsible to approve the content being displayed to the public (i.e. using the Content Approver role). The last thing an editor wants to see is some crazy text flaming around everyone and displaying unacceptable behaviour (i.e. a text with racist remarks), or a picture that does not reflect the news report, or even worse, a picture that can potentially harm the viewers for being shown in the public.

To make short a long story: A content-based enterprise needs someone to be responsible for content approval.

Now, coming back to our technical venue.

Of course we want to enable content approval. So we go ahead and call:

SPList.EnableModeration = true

And out of the blue during some point of the execution an exception is thrown every time this line is called. That was a surprise for me.

So I went on to MSDN to read about the property and the object and…no clues or answer to be found. I went to see what happened with the other libraries using the same code. In the vast majority of the libraries where I ran that code, they let me update this property, but a few did not. so, what went wrong?

Then after some research and no clear answer, I decided to debug the SharePoint DLL via code reflection. I went to see on MSDN which of the SharePoint DLLs contains the SPList object and as indicated it is the Microsoft.SharePoint.DLL.

I’ve got the DLL and then compared the signature of my reflected copy against the copy installed in the GAC. Just to make sure we all were talking about the same “story”.

Note the member signature. There is nothing unusual here. It is a get / set, but let’s take a closed look at the SET method:

Interesting. “if the base template is a picture library then ERROR”.

Regardless of any test or comment. If we are dealing with a picture library, it seems to me that you can not enable content approval for it in SharePoint and immediately an exception is thrown.

IMO, I find this quite odd because in other instances, similar to this case, it is common place to expose another member to validate this test. For example, I would look for something like along the lines SPList.CanEnableContentApproval.

Anyway, moving on, problem found. I am not sure why content approval is not available for picture libraries. Indeed, if you go to the versioning settings for a picture library you won’t even see these options listed.

The solution : As of today, for me the way out of this is to use document libraries to handle the approval process for images. (if you have any other strategies for this matter, please let me know)

Now let’s take a look at the code to handle the full versioning control. Enjoy.

1 /// <summary>

2 /// Applies the versioning settings to the list.

3 /// </summary>

4 /// <param name="selectedList">The selected list.</param>

5 public void ApplyVersioningSettings(Microsoft.SharePoint.SPList selectedList)

6 {

7 // enable content approval for this list

8 // moderation is not supported for picture library types

9 if (selectedList.BaseTemplate != SPListTemplateType.PictureLibrary)

10 selectedList.EnableModeration = true;

12 // enable versioning for this list

13 selectedList.EnableVersioning = true;

15 // set security to only users who can approve and the actual content author

16 selectedList.DraftVersionVisibility = DraftVisibilityType.Approver;

18 //enable minor versions for this list

19 selectedList.EnableMinorVersions = true;

21 //set YES to forced checkin/checkout required

22 selectedList.ForceCheckout = true;

23 }

See you later

-Edge

2009-08-09T00:48:00.001+10:00

RSS is a great thing. It streamlines easily the communication between a content provider and its readers. RSS nowadays are everywhere. News sites, blogs, content driven sites. By subscribing to a RSS feed you can reach a broader audience by eliminating the need of a computer, just have a mobile with RSS reader capabilities and you are good to go. As a powerful content management tool, of course SharePoint enables RSS syndication for its contents.

Let’s take a look at the UI page where we can configure the RSS feed of a document library:

So, can we customize the RSS features exposed by a SharePoint library programmatically ? The answer is yes, but unfortunately this task is not as straight forward as one might think.

If you look the SPList properties, you will not find anything related to them. If you look at the SPListItems, you will not find anything related to them.

So where are these properties? They are in fact in the RootFolder property of the list. The RootFolder is an object of type SPFolder and sets various properties for the files and contents associated with the list as a collection of items.

And guess where these RSS feeds settings are specified? Yes, in that same collection, exposed as a key-value pair. But even if you try to inspect that with your preferred tool, you won't be able to see it clearly. Not even with SharePoint Manager sometimes. For example, take a look at these 2 RootFolders properties, from 2 different SPLists, being visualized with SharePoint Manager.

So…You see, the first one does not expose any RSS related property values, but the other one does. That's because the later has SPListTemplateType.DocumentLibrary as its base type.

Since the SharePoint operations and behaviours rely extremely on the exposed APIs, we would assume these are the kind of stuff you would have access via an API call. I for one was not expecting to modify straight into the property values of a key-value par exposed by a SharePoint collection itself. Yeah, pretty tricky. SharePoint does its own things by its own ways.
Anyway, these are the things you can modify from our RSS settings screen:

1) EnableSyndication : internal property, refer to the code below

2) vti_rss_LimitDescriptionLength : Controls if the item content will be exposed complete in the feed of just the first 256 characters.

3) vti_rss_ChannelTitle : name the RSS feed

4) vti_rss_ChannelDescription : Short text to describe the feed

5) vti_rss_ChannelImageUrl : Specifies which image will be displayed when a RSS reader consumes the feed

6) vti_rss_DocumentAsEnclosure : Indicates if will any documents associated with the feed are included as enclosure. ( I assume, becaue I have not tested that to explain better )

7) vti_rss_DocumentAsLink : Indicates if you can expose the documents included in the feed as link direct to the file. Very common for podcast RSS feeds, for example.

8) vti_rss_ItemLimit : Limits how many items are going to be exposed in the feed

9) vti_rss_DayLimit : Limits how many days will the feed content display. This will work combined with the vti_rss_DayLimit; the most restrictive one, wins.

Also there are some more fields that are not exposed by the UI, but still exists in property collection:

vti_rss_DisplayRssIcon : Indicates if the image in the vti_rss_ChannelImageUrl is an icon file. It will be displayed in the navigation bar of web browsers, for example.

vti_rss_DisplayOnQuickLaunch : I did not test that, but I imagine it will add the feed to the quick launch links in the homepage.

After all the settings were done, there is one more catch: Call the Update() method not from the list, but from the RootFolder object.

Now, the code to set them:

    1         public void ApplyRSSSettings(Microsoft.SharePoint.SPList selectedList)
    2         {
    3             // display RSS for this list
    4             selectedList.EnableSyndication = true;
    5 
    6             // set NO to truncate RSS multiline text to 256 chars
    7             selectedList.RootFolder.Properties["vti_rss_LimitDescriptionLength"] = 0;
    8 
    9             // set NO to include file enclosures
   10             selectedList.RootFolder.Properties["vti_rss_DocumentAsEnclosure"] = 0;
   11 
   12             // set YES to link rss to files
   13             selectedList.RootFolder.Properties["vti_rss_DocumentAsLink"] = 1;
   14 
   15             
   16 
   17             // set RSS maximum items to 25
   18             selectedList.RootFolder.Properties["vti_rss_ItemLimit "] = 25;
   19 
   20             // set RSS maximum days to 7
   21             selectedList.RootFolder.Properties["vti_rss_DayLimit"] = 7;
   22 
   23             // commit the changes to the list
   24             selectedList.RootFolder.Update();
   25         }

See you later

-Edge

2009-08-07T00:09:00.001+10:00

In Windows SharePoint Services, all the lists are assigned inherited permissions from the container site by default. So how can we programmatically change these permissions to our own?

First we must understand how WSS controls access to its objects.

The access model for websites, lists, document libraries, picture libraries, task lists, workflows etc follows a role-based membership model. One might even say that's quite expected since WSS extends the capabilities of the ASP.NET as an application itself and .NET has a very flexible role-membership model framework.

In this role-membership system, SharePoint users are assigned to specific roles, specifying what kind of access he/she will have (full access, read-only, write-access etc).

You can do this just like SQL Server, where groups are created and then users are included in these groups. The next step is to go to the Sharepoint object (a list, for example) and assign permissions to that group; but SharePoint extends this model one step further by creating role assignments.

A Role assignment is an object that binds roles and groups/users. This role assignment object can then be grouped in collections and that's where sharepoint do the trick: All the list objects in WSS implement a collection os role assignments which makes this approach the best and most scalable way to set permissions. Such a model can even be extended to apply to specific permissions to specific list items within the list. Even websites implement a collection of role assignments.

Can you create a role assignment for a specific user without specifying the role?

Yes, we can. The user will be listed in the collection for the object but he won't have access to the object. So it's really pointless doing this.

Can we cascade permissions across lists?
Yes, we can. Not only across lists but all the objects. By default SharePoint will let you inherit the object's parent permissions. This behaviour, by the way, can also be modified programmatically as we will see later.

Can we assign specific permissions for just a group of items within a list?

Yes. And the process is very similar to the one we are going to demonstrate here.

What is the highest group on a SharePoint site collection? Is there such a super group?
yes, it is called cross-site group. It is an OTB functionality and by default has 3 sub-groups: Owners, members and visitors. Owners are the site administrators, members are the people who can have write-access to the site, visitors are the guests and can only read information.

So, any given user only becomes an effective SharePoint user once it is assigned to a role. You can take a look at the base permissions querying Microsoft.SharePoint.SPBasePermissions.

Now...In our case, we will remove all the predefined permissions for a given task list and set our own permissions. Only the people who are site administrators will have access to it.

First thing is to break the inheritance to the list. That will untie the link between the list and its parent's permissions. The immediate effect you will notice on this command is that the UI will change accordingly.

NOtice how the menu in the UI get updated. You won’t see the tab refferring to the parent’s permissions anymore, instead you will be presented with an option to edit the permissions by user and a new option to revert the operation, which is to inherit again the permissions of parent.

Returning to our case. Once we break the relationship to the parent, we will need remove all the permissions in the list. If we could take a look at the UI during the code execution we would see a list like this.

with absolutely no users with permission to access the list. Note how dangerous this operation can be. If for some reason we left the code at this stage of execution we would compromise the SharePoint's health status and the implications can be very upsetting specially if the list is touched by many users or displayed in other sites.

So the next step is to setup the user we want to give the permission. In our case we want to give access to this list only to people in the administrators group.

Take a minute to see how we perform this.

Remember when we talked about the Roles and the Groups. Well, these are represented by the classes SPRole and SPGroup. So we will at some point need to have that information at hand. We extract the desired role R out of our website roles collection and our group G out of the website group collection.

There is a special trick here. In order for the group G useful in anyway, we need give a live identity to it. We will use the SPPrincipal object for that. SPPrincipal comes from the SharePoint super-class SPMember and it is the object that represents an user or a group within a website in SharePoint. Any user and any group attached to a site in SharePoint is automatically a SPPrincipal object and he will provide all the role-membership mechanisms for integration with the system.

In older versions of Windows SharePoint Services SPRole and SPGroups were used combined and straight to configure the permissions. These objects are now obsolete for that function and the recommended approach is to instantiate a SPRoleAssignment. The SPRoleAssignment will be produced by associating the selected group plus the principal identity. Once you have your SPRoleAssignment setup based on the group, you then add the SPRole to the exposed collection.

The next steps are very direct. We bind the SPRole to the SPRoleAssignment…

And we add the SPRoleAssignment to the RoleAssignmentCollection exposed by the SPList.

We create a SPGroup and SPRoleDefinition objects based upon the existing site groups and roles in our site. The reference to the site can be accessed via the SPList object itself. Since we have that information now in our hands, we can then combine them with a SPRoleAssignment object and then add this assignment to the collection of assignments that belongs to the list. Our method is pretty atomic, and at some point a SPList.Update() call must be made in order to persist the changes we’ve done.

If everything went according to our plan, we should now see a list like this in our UI:

If you want to apply specific permissions to the items of this list, the only additional piece of code you must add is a loop around the SPList items and set the properties in the chosen SPLIstItem object.

Now the code:

   11         private void SetPermissionsForTheList(SPList selectedList)
   12         {
   13             // breaks the inheritance from the parent
   14             selectedList.BreakRoleInheritance(true);
   15 
   16             //removes all the permissions from the list, except for 'site - admins'
   17             while (selectedList.RoleAssignments.Count > 0)
   18                 selectedList.RoleAssignments.Remove(0);
   19 
   20             if (selectedList.RoleAssignments.Count == 0)
   21             {
   22                 // get the defined site admins group
   23                 SPGroupCollection groupCollection = selectedList.ParentWeb.SiteGroups;
   24                 SPGroup group = groupCollection["Site - Admins"];
   25 
   26                 // get the full access role definition
   27                 SPRoleDefinitionCollection roleDefCollection = selectedList.ParentWeb.RoleDefinitions;
   28                 SPRoleDefinition roleDefinition = roleDefCollection [0];
   29 
   30                 // create a role assignment based on the site admin group 
   31                 // and bind to the full access role definition
   32                 SPRoleAssignment roleAssignment = new SPRoleAssignment((SPPrincipal)group);
   33 
   34                 roleAssignment.RoleDefinitionBindings.Add(roleDefinition);
   35 
   36                 selectedList.RoleAssignments.Add(roleAssignment);
   37             }

As a final note, remember that all this can be accomplished via the interface and by doing this SharePoint will verify and test if any rule isn't being broken during the process. By doing this programmatically you are easily introducing a new level of complexity in the SharePoint ecosystem. Via code, you can set any kind of permissions you want to any given user. PLAN AHEAD. Make sure you are not overwriting permissions that can be conflicting with other areas in the site collection.

See you later.

2009-05-17T03:03:00.001+10:00

That’s a very curious one. I have setup a custom authentication provider for my project. I replaced the Windows Authentication and used my own which is based on the .NET custom membership provider. So I tried to open the site using SharePoint Designer and do a little master page update.

When I’ve received this “neat” error message which, by the way, does not help in anything:

That sounds pretty much like one of those debug messages used during COBOL times, when a programmer had to write something on the screen in order to verify if some criteria in the application logic was met.

Anyway…I just clicked the OK and then another error:

Surely that’s a more “understandable” error message. Or at least it sounds like a decent error message. Then I said myself: “ok, now maybe the next one can explain all this mess”

So I clicked ok and I’ve got this amazing one

“Found. Object moved. Object moved on here.” That’s awesome. By then my colleagues were all having a laugh at it. That’s almost like an urban legend coming to life. The case of the programmer who left debugging error messages in the application, forgot to remove the code and the application went to market with these messages.

Yeah, it smells like one of those programmer messages left in the application during test that ended up in production. Hopefully Microsoft will revamp the SharePoint Designer so we can have a decent environment up to the level required by WSS.

2009-04-11T22:03:00.001+10:00

As a .NET programmer and an avid user of the Global Assembly Cache when dealing with SharePoint one of the things that I have to use most to test my solutions is to recycle the application pool, so that I can put my newly created DLLs and test them.

I use a lot WSPBuilder for this task, but I always wondered : How can I recycle the application pool via command prompt ?

In case you ever wonder the same and still don’t know how to do it, here’s how:

the cscript command is pretty neat. And mostly the Microsoft Platform applications have a .vbs file assigned to them, so give it a try and try some other cool stuff in other apps.

See you later,

-Edge

2009-04-10T22:50:00.002+10:00

2009-04-10T22:38:00.001+10:00

One of the main selling points for implementing SharePoint are its content management capabilities.

This week I went to a client demonstration of our new site and I noticed that a MOSS enabled website is really appealing to them (end users) but not so much because the underline features or that cool RSS integration you demonstrated but mainly because the ability to manage and roll out content on the web itself.

As a topic of later discussion amongst us something was obvious: people do not really understand what’s the concept of Site Branding, and for that I believe it is paramount for us consultants to deliver this message for them very clear so they can have a better grasp of their brand new SharePoint site they will be maintaining themselves when we finish the project.

So what is site branding from SharePoint's point of view?

It is called Web Content Management, WCM, and it’s function is to make a clear cut between what’s site branding and site content.

Site Branding is created by a marketing team, normally a group of designers and sometimes for developers. It responds to questions such as site navigation, look and feel, style etc. In other words, it is about HTML, CSS classes, icons, master pages, page layouts etc.

Site Content is created by site managers, contributors, editors etc. They have the task to choose the layout, choose the icons and images to be displayed in the site sections, they add videos to the pages, they populate the text with links to other relevant sites and contents etc.

So, now that we have this picture well defined we can infer that developing a SharePoint website is also to determine the underline appearance of the site itself.

Normally the task to develop the branding is handled over to a 3rd party company. Someone specialised in websites, and better matching colours and with experience to create a visual identity. As a matter of fact, Microsoft has made available to the general public all the CSS classes used by a typical Windows SharePoint Services application (WSS), they can be seen here

Honestly that’s a concept one has to capture and, like most things in life, it takes practice.

If you are a power user, a site editor, a tester, business analyst, project manager or any other role involved in a SharePoint site that doesn’t need to know how the things works under the hood (workflows, code, architectural designs, service contracts etc) and you are interested in learn more about site customization using SharePoint I suggest to read this 3 part series from MSDN, specifically targeting the Web Content Management features of SharePoint.

Part 1: Understanding Web Content Management and Features

Part 2: Extending WCM

Part 3: Creating and Configuring WCM-Enabled Sites

You see, handling the client’s expectations with the project its not only meeting the deadlines and delivering the project but also empowering them on the tools they can within SharePoint itself so next time they come talk to you asking for a new variation they will be more aware of the things he can or can’t do.

If you need any more information about how to do branding in SharePoint feel free to email of leave a comment.

See you later

-Edge

2009-04-05T00:09:00.001+10:00

There is a very common misconception about the uses for SharePoint and I would like to talk about one of them: Using SharePoint as a file repository. Of course SharePoint has great features to enable file sharing and versioning control across the enterprise, but is it so much more than this. So I decided to elaborate a challenge: How would you go about to setup a SharePoint/MOSS solution as an application architecture?

And let’s make the challenge a bit more interesting, shall we. WPF Composite Application Guidance (PRISM), Windows Azure, Sculpture, MVC, ASP.NET. What all these new technologies have in common? They all have deployment options for the Cloud. So, our challenge will be not only design an application using SharePoint but also design a SharePoint application using the Cloud as subsystem.

How can we design an application for the Cloud?

There are many approaches, but I would say the most likely models are:

Line of Business running as services that can keep their data in the Cloud and have web pages as UI.
Web applications hosted entirely in the Cloud.
Various systems designed as message-based applications using the Cloud as media and components like HTTP, REST and SOAP as protocols.

One of my passions is photography so let’s design an application where people can contribute with pictures to the cloud via SharePoint. In our case study, we have to consider the following scenario:

many pictures can be uploaded by a single user.
many users can submit their pictures at the same time from several locations across the world.
Every picture will have a little story about it. Whoever upload the picture must tell the story associated with it.
the pictures and the stories can have multiple formats
many devices can be used to upload the pictures (desktop, notebook, mobiles)

In the other side, we will have customers (agencies) consuming these contents via exposed services:

one agency can query as many times they want for shared and approved content.
many agencies can submit their queries at the same time
many devices can be used to query the results (desktop, notebook, mobiles)

So let’s take a look at our suggested model:

Our main enterprise application will be hosted in a SharePoint/MOSS application where the business owners can control it from there, use the BI tolls and apply KPI tools if they wish to. Also via developed custom web parts hosted in our SharePoint site they will have access and create reports targeting our File System impersonated by Windows Azure in the Cloud.

Web services will be developed and exposed using our own APIs to allow communication with our file system in the Cloud. At this point, we want to be agnostic and pragmatic. Just because we are using SharePoint and Microsoft Cloud, it does not mean we have to be attached to Microsoft tools. Since Web services and the Cloud itself work under well-known protocols any client can then interact with them. We can have desktops running Macs searching for pictures and text, we can have mobiles using embedded Java to upload pictures to our application and we can have other agencies using our own exposed API and integrating our system into theirs and querying the results via SQL Reporting Services via XML.

What should be our focus when designing such application ?

It does not matter the chosen technology provider. IMHO, the most important factors to cover here are: Scalability and Application Services

Why Scalability?
Let’s take a step back and think about how is this application going to be in 2 years time. Scalability means provide a good tolerance for expansion without compromising the quality of service in our case. Overtime we expect a growing user base and file storage usage by pictures, descriptions, user profiles, texts or whatever it is; but not only this, we should expect a growing number of requests per day by users all over the place. If we wanted, we could even expose services as plug-in for third-party consumers to provide our services in their own applications. Scalability must provide enough room for this to grow in the future

That’s when comes a brand new concept: Infrastructure as a service. High scalability and high availability are the main features of such environment. Who today can offer such a worldwide service? the Cloud. and with another good thing to take: The Cloud is agnostic.

So, here we have our chosen infrastructure media.

We are going now to develop .NET custom code implementing the Windows Azure APIs and make them as components in our SharePoint application, which can be distributed in our SharePoint pages as web parts hosted on Web part Zones.

Why Application Services?

Here the biggest concern is relating to the many devices allowed by the system per user. It is impossible nowadays to have an application dictating what the user/client must use or not, and if you ever do this it will be in no time your competitor's biggest strength.

At the same time, many RIA – Rich Internet Applications are available and will want to be using such a service base, like iPod Touch and other mobile devices. To implement these we need to think about Composition Interfaces.

Composition Interfaces are many pieces of various design patterns combined to allow writing flexible UIs according to the user. We can even use ASP.NET adaptable rendering controls to minimize our design time. So by using a ASP.NET text box within a custom web part in our SharePoint site page to upload pictures, it will be rendered with no problems when this page is accessed via Firefox browser or a Nokia cell phone as well.

Flexible UIs allows us to develop both simultaneously and with personalization according to the user’s needs.

This given scenario is also a great model for sub locating tasks to other groups via design by contract.

To design an application by contract is to specify, document and make available all the expected inputs and returned outputs from our system, in our case our SharePoint site, so others can develop targeting our platform in a very interesting way because now you can give them a task, tell them the APIs to use (for uploading photos or querying texts) and they then develop the module based on the contract. It also introduces a very important aspect of it which is the atomicity. If their part somehow breaks down or has a bug, it won’t affect the main system because the calls specified by contract are already sanitizing the inputs and outputs.

Another added benefit is that such architecture is modular enough from the solution interface. You can clearly give a demonstration to the project’s stakeholders explaining the contract’s model and the interfaces without touching the internal processes and they will most likely to understand. It is like having a helicopter view of the solution.

So, there you go. Now when someone tells you that they use SharePoint to save files and share resources in their Intranet you can tell: “SharePoint can do so much more than this!”

2009-04-04T16:34:00.001+10:00

Today I would like to talk about Features in Sharepoint. Features is a model provided by Sharepoint what reduces the complexity of deploying site customizations and at the same time provides to the team a strong and consistent way to perform many deployments as necessary following a well-known and documented process.

By wrapping up content deployment in Features, you are also likely to implement versioning control since each package can be labeled by version.

How to Implement a Sharepoint Feature?

Let’s assume you are using Microsoft Visual Studio.NET. To implement a Feature, you should mimic the current Sharepoint file Path in your solution. Go ahead and create a path called <yoursolution>\12\TEMPLATE\FEATURES

There you will place all the necessary content for the Feature. We will use WSPBuilder as a preferred tool to ease our task as well. If you don’t have WSPBuilder you can get it from our tools page.

You will see a file called Feature.XML, this file will tell you the location of the assemblies, files, references, resources etc included in your Feature deployment. The xml file also will allow you specify a friendly name for your feature. like: MySiteBrandingContenttell , for example.

Now let’s say you want to add a whole bunch of images to your site. Just go to the Style Library/Images folder and add them there. Remember, our folder structure is mirroring the actual Sharepoint folder structure.

Now let’s take a look at the elements.xml file.

Note the section called ImageModule pointing to the url style library/Images.

This section will ultimately tell Sharepoint (via WSPBuilder) all the files that must be present inside your Feature package. So you should go and edit this file, adding all the images you want to distribute with your Feature.

That’s an OK process, but often we have dozens if not hundreds of images to deploy. So here’s a nice trick to quickly populate the section.

First you open via windows explorer the location where all the images are located.

Get the folder path, which depending of your solution can be quite big.

Make a list of all the files you want to add to the xml section into a text file. And here comes again another trick, from the good-old-days of DOS. The command below will list all the files, just the names and save it into a file in your computer.

Open this file, select all the files and copy to an Excel spreadsheet (or any other similar toll like the OpenOffice Calc)

Now, another trick. Use this formula within your spreadsheet. This when applied to the content will format the whole document perfectly for use inside your XML feature file.

Now you just have to copy the content generated and copy/paste into your section.

Right-click your solution and rebuild the project.

Voila! You’re ready to deploy your feature.

Now comes the part when WSPBuilder is really handy. If you have it installed in your computer you will notice the context-sensitive menu integrated within your Visual Studio environment. Right-click again your solution and choose Build WSP

If everything went as expected, right-click again and then choose Deploy. This will effectively deploy the solution to your environment.

How Does WSPBuilder knows where my Sharepoint Site is? It will pick it up from the project properties/URL path.

In any case, the package will be created under your solution/bin/deploy folder. A batch file called deploy with stsadmn is also going to be created if you decide to deploy it manually without having to remember all the stsadmin –o directives for it, or if you want to take the Feature package to another server.

Now go you your website and see all the changes applied. Your feature should have been deployed successfully!

Why I can not see my deployed features?

That’s because you need to disable the feature and then re-enabled it again to see it in action. By doing this you are forcing the files to be copied over to the actual Sharepoint site.

You do this. Go to modify all your site settings:

Go to the site features, where you can see all the listed features in your site.

Then manually deactivate and activate the feature.

There you go! Your feature is got to be there now.

2009-03-25T16:48:00.001+10:00

When configuring, developing or performing any sort of action inside the Sharepoint environment not very often we see error messages, assuming you’ve been doing the right things. For all those other cases when you can’t Sharepoint might display this default error message:

So, how do you know where did your application break?

You certainly can go to the ULS (Universal Logging Service) and trace the enormous log file or you can do this.

Open the web.config file of the website and change these values:

And this one:

Next time you try to run your application you will see the full stack trace, just like any regular .Net application.

Obviously, this is a development tip. The best practices probably won’t recommend you to do this on a live website.

2009-03-19T13:00:00.000+10:00

Here there is something interesting that I would like to share with you guys.

Even thou Microsoft SQL Server 2005 is out for quite some time, it is still common to see people working in projects using Microsoft SQL Server 2000 and often in mixed environments.

That's the case I want to talk about: The mixed environment, and I am working in a project where some applications have that hybrid configuration.

So someone told me that my report developed in .NET 2.0 was running slower than the similar one done in the old fashioned ASP. Of course I denied, just to see later the proof I was wrong.

Yes, the same stored procedure executed from the same page from, in the same machine was running faster in the old environment while it was slower in the new (and supposedly improved) environment. How's that possible? I traced the execution, used the SQL profiler but nothing gave me a good clue. Than I found this in the Microsoft website.

In SQL Server 2000, the execution plan for the query uses an Index Seek operator. In SQL Server 2005, the execution plan for the query uses an Index Scan operator. The optimizer produces an index spool for the Index Scan operation. When you use the FORWARD_ONLY cursor, SQL Server scans the index for every FETCH statement. Each fetch takes a long time. Therefore, the query takes a long time to execute.

See that example below:

50 declare @p1 int

51 set @p1=0

52 declare @p3 int

53 set @p3=16388

54 declare @p4 int

55 set @p4=8194

56 declare @p5 int

57 set @p5=0

58 exec sp_cursoropen @p1 output, <Transact-SQL statement> ,@p3 output,@p4 output,@p5 output

This code will run faster if you are NOT using the .NET 2005 SQL Connectors or running in a SQL Server 2000. Here we are using the sp_cursoropen to open a cursor, then specifying the forward-only option in the parameter list.

This is a bug you can only experience if you are using a lot of cursor-based stored procedures from a SQL 2000 to a SQL 2005 environment, and here we have a VERY HIGH cursor usage. (not that I like them neither I defend its usage, it is just a fact from the environment here)

How to fix this?

If you do not want to download and apply the patch and want to fix this in the code itself use "OPTION (FAST 1)" in the stored procedure call. That will make it run faster in the SQL 2005 machine.

See ya later

2009-03-18T19:31:00.000+10:00

Here an interesting case. Consider there 2 scenarios:

Both are running the same website, both have the same amount of users connected.

Now imagine this website has a page to upload pictures, just like any regular photo-album website.

For some reason, at some point the users complain that they see an error page indicating out of memory error.

So, you wonder: How come? they are just uploading a photo to my website, and I still have plenty of memory in my server anyway.

Anyhow, you stop thinking about this and go for the easiest, quick and dirty solution: If the system tells me that my computer does not have enough memory then I just need to add more memory. Right?

And guess what? you still will get the error message.

That's a very common mistake. Having a machine with 10GB of memory does not mean you will have 10GB of memory available. I explain.

It does not matter if your computer or server has 512 MB, 1 GB, 2 GB, 4 GB or 8 GB of RAM. If your machine is a 32-bit machine it will only be able to see/manage 4 GB. That's mathematics, that's life, that's the way things are and you can't do nothing about it. A 32-bit machine can not do more than that.

Additional memory may increase your system performance, but it won't increase the memory availability. Sure your computer will use less the hard disk for swapping operations and will be able put more stuff in memory and start some programs faster, but 4GB is the limit; after this point the memory management module will start doing disk swap and to use the famous page file.

And here comes more bad news: Your Windows system on a 32-bit machine requires 2 GB allocated only for it.

So, if you have 4 GB installed, effectively you will have 2 GB only for applications; your windows will be using alone 2 GB.

So, what does out of memory means?

Well, according to some people at Microsoft, this limit for an average configuration is reached between 600 MB and 800 MB of utilization. That 800 number is NOT A RULE, is a baseline. Generally speaking the largest majority of configurations with website, .NET and SQL Server database might have a problem around this point. Of course, this can vary from system to system...as a matter of fact a system can be out of memory at just 600 MB.

Yes, it does sounds crazy. You look so happy now that you just bought a 4GB RAM notebook and your computer is breaking with just 800MB, hun?

Here is another point for you. Have you ever seen someone bragging that he/she bought a 10-megapixel camera and now he/she believes their pictures are going to be better because of this?

Well, guess what? Just like the number of megapixels in a camera box does not have much to do with picture quality, RAM memory does not have much to do with hard disk space.

That's a common mistake: People buy RAM as if they were buying a hard disk.

RAM usage needs to me continuous, unlike hard disk. A simple 5MB Microsoft Word document when saved in a hard disk can be split up in hundreds of pieces; When you open this file in memory, the RAM requires those 5MB to be allocated continuously.

Can you see now the reason for the 'out of memory' message?

Yes, it really means 'there is not enough continuous memory to place that file in memory'. Your system might have 2GB of RAM but unfortunately it might be too busy with stuff running and there is no enough continuous memory to put the picture you are uploading.

Yeah, you can not do much but you can buy a 64-bit machine then when you add more memory you can really use it more efficiently. And yes, we have Microsoft Windows systems for 64-bit machines.

If you do not want to buy a new system of upgrade you current server to a better version then you should think other solutions in the business process, such as to avoid users upload pictures with more than 1 MB in size to be uploaded.

See you later.

2009-03-14T21:37:00.001+10:00

I am an IT guy. That's clear but often I think about many situations from a salesman's point of view, trying to view the world from another angle that I sometimes have no idea how it could be.

What do I mean by that? I'll explain but before please let me share with you this.

I must recognize, even thou IT is a really cool area to work and even thou because the pace it is so demanding we must run everyday just to remain in the same place, unfortunately not always we have the chance to deal with cool and state-of-the-art technology. Yes, sometimes we have to deal with repetitive tasks, sometimes boring tasks, sometimes old products etc. If you are an IT person you know that and might agree with me. Legacy base is a consequence of this fast paced world, as well.

In those situations we wonder: Mate, I am doing this because it was handed over to me out of nowhere and I know this is no rocket-science and despite that I must finish it by tomorrow. I bet we all at some point of our carreers dealt with this scenario, which normally leaves a strange taste in our mouth telling us there is nothing new to be learn from that experience.

Fear not my friends, there is always something to learn does not matter the scenario.

Now, let's get back to the sales person thing I was talking about.

The sales guy after a contact, client visit, sales performed, email delivered to a potential customer, whatever the reason, there is something they must do which is ask himself : What could I have done better ?

Sounds easy and trivial but that's a hard thing to do and as a matter of fact that's something I am trying to do with myself: What have I done today that I've could do better ? What I've done wrong today ?

As the time goes by this becomes a habit just like drinking coffee at 3pm and soon you'll picture yourself in a state of eternal improvement, or at least awareness of it. I am not telling you this is a magic rule to follow in order to achieve the perfection, far from it; but it certainly does something to us which IMHO is a must for a better version of ourselves: It takes us out of our comfort zone.

Yet there are people out there who pay for this kind of professional service, Personal Coaching. Honestly, would be great to pay for one of those but I still prefer to put my hard earned money into my mortgage or my kid's school fees. So why not we become our own Personal Coach?

How do I do?
I ask myself: What could I have done better? and I write them on paper. I make a list. I put them on paper because I want that document to be a reminder, and you know what? writing it's free and doesn't hurt, specially the bad things and mistakes we made. Yes, the mistakes are important also because they will be like beacons in this dark ocean of our tries, but I try not to concentrate too much on them after all mistakes are consequences of tries. If you do not do many mistakes it means you haven't tried enough.

Just to illustrate look at our mailboxes with lots of emails trying to sell us stuff. Pay attention to them, I could say that the vast majority is really badly written, from the sales point of view of course. Lots of information about the product requirements, features and prices but very few information about how it would make my life easier or things like why I should buy it now and save effectively 1 hour of coding everyday.

The truth is: very few of them talk about benefits. Very few of them mention how their product will help the customer with its problems.

So, here it goes a good exercise: Try to find out what else that message wants to say in the email selling you stuff. Why I should go for this product instead the competition? How would you write the message to appeal to people like yourself. And how to put yourself in other situations out of your comfort zone? Try to think about markets you don't know much about, like think how would you manage that coffee shop. If you were an attendant how would you receive a client like yourself looking for a good coffee during the working day?

Excellence is not a point to reach, it is a trajectory made up of very very small baby steps. Hundreds of them taken one at a time, one each day.

See you later.

2009-03-14T21:35:00.001+10:00

This weekend I went to a friend's house and we talked a lot about photography, another passion of mine. So I decided to use my iTouch to show him my online portfolio:

- sorry man - he said - I have to tell you my home network name. Otherwise you won't see it available to connect.

- what do you mean? Do you hide your wireless SSID?

- Yeah, I do this for security reasons.

And yet again here we go, another old security myth: Hiding your wireless SSID makes your home network safer.

First of all, what is this ?

In your house you may have Internet access. If you have a laptop what the people normally do is to buy a router, then connect the Internet cable to the router and then the router will 'emit' the signal to the air. This will allow you to connect to your Internet from your bedroom, kitchen, talk to your mother over MSN while walking around your house etc. Everything wirelessly, as long as you can still get the signal. And for that we give a friendly name to this signal called SSID, so you know where to connect.

The thing is, everyone who has a computer with wireless connection also sees your signal.

So how to avoid them to connect to your Internet and make them surf by stealing your connection? Well, you set a password to connect to your router, so when anyone try to connect they will be asked for it.

And here we get to the point: the SSID is not a password. As a matter of fact, the SSID was designed to be public, yes. So by making it public or hidden it really does not change much the security scenario. And besides remember what all the security experts say: there is no security by obscurity. Just because it's hidden it does not mean that it is safe.

So he decided to hide the SSID. Ok. It does not matter, it is not much hidden anyway. Let's see.

The wireless network that you have at home send packages of data-to-air, some are encrypted, some are not, and inside those who are not encrypted they also contain your SSID name. Simple like that and written in plain-text.

So if I am a hacker, I could use a sniffer program to capture the packages and open up to see what's inside. A lot of them I would see crazy stuff, those are encrypted; but in some of them I would see things of the like: trying to connect to SSID name 'myhomenetwork'.

So there we go, our secret is now gone. Do you still think you're safer after that?

Can you reduce the amount of packages without encrypted information? Yes, but you can not stop them 100%, so at some point they will be sent.

Another thing to worry about. If you use Windows XP we can observe an interesting behaviour. If your SSID is hidden, but the laptop is connected to the Internet, XP still apparently keeps sending requests to join the network, continuously. And guess what? The router will reply to your requests using non-encrypted messages.

Funny thing. If we think about it what we are doing here is make our hidden network sends over and over and over again a bunch of replies with not encrypted data with your so-cool-and-hidden SSID.

Why Windows XP and Windows Vista behave like this by default? because SSIDs were, as I mentioned before, designed to be public and I my guess is that Microsoft did this to comply with some governments cyber-laws. I've heard that in some countries, like the USA, it is a crime to keep your SSID hidden and to use hidden identities and hidden networks... all that stuff. I can't confirm that, so it is a guess, but it makes sense to me.

Hiding the SSID won't hide you from the wireless world. Unfortunately people still relates hidden things with secure things.

So how to make my wireless Internet at home more secure? Use something called WPA/WPA2. That's good enough mostly the times. If you are using WEP, change to WPA2. If you are running Windows XP and you have applied all the updates, you are safe. For Windows Vista is even easier because WPA2 comes with it out-of-the-box.

Here some stuff about securing your wireless internet

See you later

2009-03-14T21:34:00.001+10:00

It does not matter the current state in which an application is, everyone always wants a bigger, better and faster version. Yesterday talking to my peers we discussed this point: If you have to choose amongst these items, which one would you leave for last? I said performance.

My point is: To design for high performance is expensive and on these times of ROI is a good thing to save some for when we need it most.
In my first job about a decade ago, I had to work with protocols and microchip programming. In one of those projects I had to implement a little protocol to communicate 2 heaters. I asked to use C, after all I was studying it at the Uni.
At the same time, there was a group of cool people programming in Assembly and these guys told me to give Assembly a try, for performance reasons. I told them:"Guys, I do not have experience with this and I prefer to use C. It will be even better for my grades in the future tests."
Truth must be said; the prototype was done and indeed it was too slow. Way too slow.

It was during my young years and I still remember all the comments I've heard about this bad performance. Those comments just fired me up! I was in a mission now to prove them wrong.
I asked for more time, and with more 2 friends we debugged the code. We were wasting too much time during the handshake. That's it! we found the bottleneck! I said. So we implemented just that handshake part in Assembly.
After some fine tuning: the application was now too fast!

Nowadays, I see people putting too much effort in new technologies, new methodologies and focusing too much about performance where is not really needed. use datasets or use MVC? Use an array list or a generic list? That’s something like over-engineering an application. IMHO, this can lead to complex and expensive systems to maintain.

So, lessons learned from this situation:
First, make sure you have freedom to use your skills in the area you know most. Sometimes we are forced to follow an already designed specification and there is not much freedom for our own ideas. The project priorities supersede our own priorities. If you have this ability then...

Second, do proof of concepts. When you find a proof that is modular enough to detach and that works good enough above the average, move on to the next module...and then...
Focus the effort in time and money with the most critical parts.
Be sure of that: Not even Jesus pleased everyone. At the end it does not matter how effort you placed in the application or how cool you did that module using a new logical path there is always people telling you it could be done better.

That's software, that's simple and that's life.

but hey, these are the sort of comments that makes you want to be better, to improve and move stronger ahead, aren't they?

2009-03-14T21:32:00.001+10:00

The Entity Framework is out there and it is common term already in the framework talks. There are hundreds of sites dedicated to its best applications and best architectures tactics.

When an architect is involved in these talks the good ones always bring the discussion up to a helicopter view, since the discussion will inevitably move towards the best model and to comparisons against the 'what-would-be-the-perfect'.

Now seriously, is there any perfect framework model?

The purists’ attacks against the Microsoft EF always say that "EF is not an independent layer neither multiplatform oriented", so it can't be reused and integrated with ease across the other systems in the enterprise, for that would be the dreams of any architects.

Since the introduction of shared folders you could easily for example place a text file in some URI and use it shared across many systems. Obviously as we can see the data would not be cached and few few mechanisms were available to raise a notification to the data holders about that update. The EF is not supposed to accomplish that task as it is a framework to access data using objects.

So here it comes another point: should we put a data access layer above it?

Remember, Microsoft data access methodologies have been changing dramatically over the last 5 years, which paves the way and gives us hints that in a near future it will change again. Legacy systems will be always a reality of the high paced IT market. The arguments against it is that having so many layers in an application will over-engineer the problem and will affect the performance and maybe the final costs rather than a simple refactoring. Remember the discussion about table normalization and de-normalization? It is pretty much the same here. These people are the same that advocate it is better to achieve the application's ROI before any major refactoring. And honestly, 5 years is not enough time for many application to break even the ROI.

Here's a scenario for discussion: A programmer decides to use EF and he maps a common class against the database. He notices that it is very simple IF ONLY he follows 'the yellow-brick-road'. For what I have seen he must follow the EF rules; he must inherit and implement mandatory interfaces dictated by the EF so everything falls right in place. If not, the EF will be just one big expensive fancy feature. Yeah, there is a term for this: Persistence Ignorant. In a glance is like the EF do no adapt to the model, you have to make the model adapt to the EF.

A model should be model ignorant especially nowadays where test-driven development is becoming common in the companies. You can actually test business rules in a higher level. That's why we start to see things like Linq for SQL and binding interfaces. They want to cover the gap left by the persistence ignorance.

The consequence of this is that more and more people are using EF as a data access tool and left to using Linq in the business layer. The business layers will then return datasets within structures called ObjectContext. And good news, the ObjectContext is transactional meaning that you can use System.Transaction to keep the data update rules properties. EF, Linq and ObjectContext: Is this a new implementation being born? Only time will tell but at least they are simple to use, have good performance and gives the programmer good deliverable times...long gone are the days when developers wanted to stay long hours at the office.

Strong points for the EF:

All the query results are objects and you can parse and traverse them in memory without any cost;
There is an embedded conceptual layer where you can do things like denormalize the data structure without affecting much the application.
Linq can be restricted to be used ONLY when needed; Linq is great but it is no silver bullet and people are tempted to overusing it

In a way, these properties are familiar to the typed dataset, aren't they? If you started programming with typed datasets, to migrate to EF is almost natural and has the advantage that now you can isolate a business logic layer with contracts. Translating: gives you scalability. Another good thing is the EF's capacity when compared against other great frameworks like nHibernate.

But it is perfect? IMHO, it is not... and after all, what is perfection anyway?

2009-03-09T01:47:00.001+10:00

Hi guys, I want to share with you a discussion that I’ve participated recently.

Consider this: you are a a host provider and your company will offer Sharepoint support to the public so they can pay you a monthly fee and then they setup a Sharepoint site with you.

You go for a simplistic and cheap design. You have IIS, Sharepoint installed, and you create a web application on the port 80. Within this web app you create multiple site collections. They are the sites your clients will have control for their own setups.

And how do you host multiple websites on the port 80 with a single IP address? Easy. I will use host headers – you say.

And you think: I should be fine. I will setup in away so each client will have their own separate database, they will redirect to the given URL I will provide them and according to the hosting plan I enable disk quotas for each case. For instance, if my client pays me some little money and he is a ’silver client’ I offer them 10MB; if they are ‘platinum client’ and pay me some more I give them 50MB.

All goes fine and well. You see everybody joining your company, the clients keep coming and your setup is totally independent.

so, what’s the problem here?

You are unable to offer HTTPS in that setup. If one of your clients wants to add a shopping cart area and want it to be secure, you can’t help them with that model.

The thing is, IIS can not resolve an incoming HTTPS request like that. ISS will hold the request and it is going to ask himself: ok, to which website should I give this request? Unfortunately IIS as of now can not address this question following that setup. Everybody is under the same IP.

To fix that one of the recommended approaches is to follow the diagram below:

On your IIS you will create multiple web applications, then for each web application you will want to give separate IPs and then host sites on these IPs, and then these web applications are the ones you will offer to your clients.

That’s a little bit more elaborated solution, a little bit more expensive but the gains in scalability will overcome the headaches you might have in the future with an atomic structure that at some point needs to be flexible.

And on that model IIS can finally then fix the SSL dilemma. Because then you will assign the applications to independent IP addresses on the ISS Manager.

Sometimes it takes more than a quick and simplistic approach to design a solution if you only know partially the products involved. Once you have the proposed design please be aware of the issues that are basic in the parts involved. In our case, a knowledge of IIS would have avoided a big trouble in the beginning.

See you later.

2009-03-04T23:33:00.001+10:00

Hi guys,

Let's talk architecture again, reference architecture, more

specifically SOA, and how can we map the available products and resources available from Microsoft given a SOA project?

Before I start, let me make a statement here: I will talk this from the Microsoft's point of view, since this is a blog about Microsoft technologies.

In any case, it doesn't matter what's your preferred provider as long as you are able to correctly do the mapping of functionalities to better fit your business' plans, budget and SLA. And just to revisit: SOA is an architecture where the functionalities of existing business applications are exposed and published as services.

And what would be a service? Services are software components that expose application functionalities in a given SOA architecture and they are:

- self-manageable;
- message-based oriented;
- can handle and support many protocols;
- can be published on a myriad of hosts;
- implement operational contracts, interfaces and message types;

Of course you can design some service that doesn't follow these rules, but let me tell you: Rules are made with a purpose and in our case the purpose is to design a solution where clients and services are highly decoupled, thus paving the way for the reuse of functionalities. One of the goals is to maximize the resource utilization in our project.

I won't talk here about governance, granularity, message routing, service level control etc. I won't go there for it is a much larger topic, so this post is about the technical view. Now, let's make our first diagram given what we've seen so far:

As we can see, we have here the common services of a SOA architecture such as the presentation services, collaboration, systems integration, orchestration services etc.

Looking at this diagram we can identify the aspects that we really want to map in our solution to be successful. Note that in some scenarios sometimes the security is critical, sometimes the orchestration is paramount, sometimes the platform integration is more important.

Now, visualize this filling the gaps with the products that Microsoft has to offer.

An interesting conclusion we can take at first sight is that some products can cross domain frontiers and can handle various capacities at once, such as the Windows Workflow Foundation, which can be used for interoperability services and orchestration at the same time with BizTalk Server.

What's the best option to choose? Well, to be able to see this big picture and to choose the best piece in the puzzle is your job as architect. Unfortunately many architects fall in the problem to overkill the solution.

Also important is to choose not to overkill the solution. Sometimes a simple custom application can fill the gap enough to not require a bigger solution like Windows Workflow Foundation, for example. Otherwise the whole project just becomes harder to handle and to maintain...thus increasing the ROI overtime...and the developers patience.

The message to keep in mind: any good architecture is composed by many capacities. To identify these capacities and which one of them are important for our solution is as critical as choosing the technology provider.

See you later.

2008-07-12T14:38:00.000+10:00

2008-05-07T01:45:00.001+10:00

Never trust the user input. The incoming data can be the source of many devils and a security flaw can be there just waiting for the right moment and the right person to break your application.

After finishing with the upload control I finally did the integration with the website. Now the users can select the files and send it to the website to be processed.

What are the security risks here? Something that can be called 'canonicalization issue'.

For a start all data can be seen on its canonical form. A canonical form is the most simple and most stardard form that any data can be represented, thus canonicalization is the process of converting the data to its canonical form.

Proficient JavaScript programmers are very aware of what I am talking about, and as a matter of fact in our system the user can search for a name using wildcards. So you can ask him: "Retrieve me a list of all the instances where its canonical form includes Bill as mandatory prefix" The user will probably say: "Retrieve what???" but if you ask them: "Give me a list of all the users where their names start with Bill" they will type in the system 'bill*'. The user normally does not know that but he is doing is performing a 'type of canonical query'.

Now, back to our file upload issue. A file name is a very common canonical type. You can call the same file as:

thairecipes.doc
c:\recipes\thairecipes.doc
c:\\recipes\\thairecipes.doc
c:\ recipes\thairecipes.doc
c:%3A%5Crecipes%5Cthairecipes.doc

As you probably figured the last one is the issue. Your Windows operating system will recognize the symbols %5C and %3A.

You see now because we are giving to the user the option to save in our system just about any file name he wants to at the same time we are also opening a door for a sort of canonical attack. Remember : Never trust the user. And by user I am not only talking about a person. In our context an user is any entity who uses a given resource or service, and for that matter an user indeed can be another system or another application.

A hacker would think: "how can I break into this site? Does it allow any easy access to any of its resources?". In our case, yes our website must allow the user to upload files.

What to do now? How to handle a file upload to a web server?

Well, first as a general rule you must not design a website that accept just about any file names created by the user and save it like that. As a matter of fact, any input must be validated and sanitized if possible, not only in client-side but on the server-side as well.

A better design: Do not allow the user to save the file in the web server with the filename that he wants to use. Accept the file, keep the original filename somewhere and let the application rename that file with another name and then save it. I would suggest you to use a GUID string for that matter. That way you are not only closing the doors for a possible canonical attack but also you do not give a chance to a malicious user to try to find out the filenames you might have in your server. For example, If a hacker knows that there is a file called http:\\mywebsite\mydocs\clientid1\file1.doc he will try something like http:\\mywebsite\mydocs\clientid1\file2.doc, and then http:\\mywebsite\mydocs\clientid1\file3.doc and so on. By using an internal name rule creation you minimize his surface.

Another thing to observe: You don't have to fight against and defeat a malicious user, probably there can be hundreds of hackers trying to break your code and you are just one guy against them ( and you don't want to have any sleepless nights during weekends, do you? ) They always find a way to break your code. The best option is to minimize their attack surface. Chances are they are going to move on and concentrate their efforts to break a "weaker website" if your site if strong enough for the first rounds of attack.

These would be some instinctive considerations and additionally I would suggest to take a look at implementing File I/O guidelines as well. At the end of the day, it all depends about how secure you want to be, how much time you have available to implement it and how rigid the specifications were given.

See you later.

2008-04-19T22:14:00.001+10:00

This week while I was awaiting for a new project confirmation I saw myself doing some code fixing for another project, that's something quite common and I really don't mind that. One of my tasks was to develop a little page to upload images to a server. That's not a problem, so I decided to try something new. Yes, I was very keen to use Silverlight for the task, but I used some good old javascript and a very cool concept similar to the called bubbling events, which is basically to raise an event from a determined and let it propagate up in the chain until it is captured.

My first idea was : I will create a web user control that can be easily added to a common web page and this guy will pass the list like a bubbled event.

This control will implement an interface to select and hold a list of files and will be able to send that list to the page and notify the page the list is ready to upload. Let's call it MyUpload control.

being a user control any programmer can then drag and drop this guy to any page and it must be atomic enough to not be too attached to the parent. So it inherits from usercontrol, and will have, at least for now, 2 methods called upload and a click. Here the things are getting cool. This click event is an event raiser.

When a programmer use this control, by calling the click method it will pass the selected file collection to the page. How? sending the list as arguments of the call.

The upload method must then be responsible populate the list and send this list to the caller.

Once the event is triggered in the webpage this page will loop through the items in the received file list and for each instance I will 'save file as...' and provide the path in the web server directory. This will move the file to the desired location as specified in the document request.

Could I save the files in the database? Yes, I could but all the specs for the task are done and that was the mission. So I won't discuss any matters of a better solution for this given scenario.

My upload control will have two buttons add and remove files which will be responsible for maintaining the list of files I want to upload. Why is that? because we want to upload a list of files in one shot and not one by one. Indeed, I'll spend more hours implementing this solution but at the end this will be a reusable control and as I said, any other programmers will then just drag and drop it should they need to implement a similar solution.

How do implement the code for add and remove files? That's the most difficult part and requires a good amount of javascript knowledge. Just this javascript routine can be subject of a post by itself. For now let's say the control has a private method called buildjavascript which renders in the page all the javascript methods necessary to maintain this object list.

Returning to our code behind, this list will be a collection and the best way to keep it and pass it by posting is to make it inherit from a very cool and useful class for this situation: the HttpFileCollection.

The upload button in the control will call the upload method which does nothing but raise the event to the page. The page who has the control implements already the method expected to parse the list as an HttpFileCollection object. Now, we only have to save the object as new name, being in a new location.

My initial design is done and I am doing the javascript side of things. This week was hectic but once things come back to normality and some time is left for me, I will share my code here somewhere.

See you later.

2008-03-03T05:27:00.002+10:00

Do you remember those days ?

2008-02-20T22:10:00.001+10:00

2008-02-15T13:43:00.002+10:00

Here there is something interesting that I would like to share with you guys.

Even thou Microsoft SQL Server 2005 is out for quite some time, it is still common to see people working in projects using Microsoft SQL Server 2000 and often in mixed environments.

That's the case I want to talk about: The mixed environment, and I am working in a project where some applications have that hybrid configuration.

So someone told me that my report developed in .NET 2.0 was running slower than the similar one done in the old fashioned ASP. Of course I denied, just to see later the proof I was wrong.

See that example below:

       declare @p1 int

       set @p1=0

       declare @p3 int

       set @p3=16388

       declare @p4 int

       set @p4=8194

       declare @p5 int

       set @p5=0

       exec sp_cursoropen @p1 output, <Transact-SQL statement> ,@p3 output,@p4 output,@p5 output

This code will run faster if you are NOT using the .NET 2005 SQL Connectors or running in a SQL Server 2000. Here we are using the sp_cursoropen to open a cursor, then specifying the forward-only option in the parameter list.

If you do not want to download and apply the patch and want to fix this in the code itself use "OPTION (FAST 1)" in the stored procedure call. That will make it run faster in the SQL 2005 machine. Otherwise download here and here the patches.

See ya later

2008-02-12T12:47:00.000+10:00

Here another cool thing. From the Microsoft download website you can find this:

"Microsoft IT partnered with Microsoft Research to create a VSTS 2005 extension that counts lines of code and predicts system defects. In the software development environment, insight into the volume of code being produced, and the changes applied to that code, provide measurements of productivity and quality. The Line of Code (LOC) counter provides a flexible and extensible framework for automating the LOC counting process."

Isn't that amazing ? Finally a cool software metric add-on for Team System, and if you wanted another reason to stop using SourceSafe and start using Team Foundation System guess what: It also works with TFS.

If you use Team System or TFS, get it here.

See you later.

2008-02-07T22:47:00.000+10:00

Project Meetings can be very productives but also can be a real waste of time and money.

Recently while working on a client where I was responsible to have a project development meeting as meeting coordinator. The group of participants were an heterogeneous group and despite the fact that I did not know some of the atendees, the meeting was a big success.

During a conversation on our coffee break I was asked about meetings strategies and how to conduct them.

So I am going to share with you guys here what I told them, and what I effectivly did during that particular meeting:

Every meeting MUST have 3 elements: purpose, agenda and maximum duration. If any of these items is missing, the meeting is meaningless and should not happen.

Make sure you are able to define a purpose for the meeting in a maximum of 2 sentences, for instance:"This meeting is to plan the new developments for the project X". This way, everyone will know why they are there, what needs to be done and how to proceed in order to well-succeed.

Define a clear agenda in advance. Make a list of all the items to be discussed, revised, analysed, displayed etc. When I conduct meetings, my personal strategy is to allocate a time limit for each item in the agenda and to assign the responsability to lead the discussion to someone in the group. Works as a charm.

Define a duration for the meeting, how many minutes/hours it should last. From the start make crystal clear to everyone what time the meeting will start and, sometimes more importantly, when it will end. It is amazing the number of managers who have absolutely no control of their meetings and do not know how to enforce the finishing rule. If you think you have this habit...CHANGE THIS !!!

Do not wait for the delayed people. Meetings must start on the agreeded time. Do not wait about late arrivals. Do not wait for those who need to be called for the meeting. You just make sure everyone gets notified, then when someone arrives after the meeting have started, DO NOT STOP TO REVIEW WHAT WAS SAID. Do this as a proof of respect to those who arrived on time.

If the meeting's organizer is late, Consider the meeting cancelled, and get back to work. How long is considered late? Depends on the company, but I would not wait more than 5 minutes.

Document your meeting. What I do is to put someone in charge of writing down the notes. What to put in the meeting notes? Basically the name of the attendants, the discussed subject, the agreed points, the next developments and/or actions with dates and their respective responsibles.

When the meeting is over - do not wait more than 24 hours - the meeting notes must be sent to: All the participants, to those who could not make it to the meeting and to those who might be influenced by upcoming decisions.

Keep the focus. Every meeting must have a regulator to notify the others when someone is discussing any subject outside the scope of the current topic. Ask one of the presents to volunteer for this task when the meeting is about to start. His/her task is to interrupt the meeting at any given time when the focus is lost and bring back the main subject. This new outside topic can maybe then be noted and even can be discussed in future meetings. In case of doubt regarding a specific topic being in or outside the scope, the meeting organizer has the final word.

I hope these notes can be of any help in your next meetings. If you have any comments or other meetings ideas, please feel free to leave them here and share as well.

See ya later.

2007-11-11T22:38:00.001+10:00

During my professional career up to now, I had the chance to work with all sorts of developers. From the reasonable to the excellent ones; and talking with some colleagues this week about that fact I have to say, it does not matter how bad or good they were I must say in every case I learnt something good with them. And one thing specially was common in all the cases: how to write a more secure code.

Which brings me to another point of discussion: how do you measure yourself as a code-writer? do you think you are a good coder? What makes you such a good developer? How do you approach a problem before you start coding?

And when I stop to think about the last sentence I remember an article I read about making your code safer and a concept I've learned reading the book "Decline and fall of the American programmer" from Edward Yourdon : The silver bullet. Basically the silver bullet is the only thing that can kill a werewolf, portrayed as a software bug or a business problem, and unfortunately just like this mythical creature there is no silver bullet for the real life issues we face everyday. There is no 'exact and single' solution for our problems.

So, to make you code safer is literally up to you. Nobody else, therefore excluding the programming language you use. Just because you are using C# it does not means it will be a better product than if you were using Visual Basic 6. OK, it will save you development and release time but just the language won't make your product better or your code safer. Again, only the developer can predict and treat the vulnerabilities.

And because of this we go to another layer of the development cycle: The design. A better and safer design can do much more for the final product than the language used to develop it. Safer products are a result from safer designs and good code practices.

It does not matter how good the product is. Once it is released, it can be attacked. No, that's not a sad destiny. As a matter of fact, as a good developer you must find this absolutely normal and expected. I write code with this in mind. Everyday. And even thou the clients tell me: "this is only going to be used within our department", I still do not change my mind. It can lead to a little bit longer development time, yes, but the gains in security and stability in the application are far greater.

So, I do not worry about the securities holes the application might have in a future because the application will run in a new platform and I should have done "this" instead of "that". Again: I accept the fact the application one day will be attacked. My biggest concern here is: How my code will behave when it gets attacked?

So, spend the time you want in improving your code. We should be proud of our coding skills just like a father is proud of his offspring.

And we know sometimes the parents can be blind about their sons skills and abilities. To avoid this pitfall with your code, ask someone senior to review your code. Meet someone who really knows what's he is talking about and ask him to review your work.

If this person is really good, I have two words of advice for you: Be humble and prepare yourself. Asking someone to review your work can be an amazing learning experience about yourself and the way you see the problems.

Remember what I mentioned: you always can learn something new, from the good and from the not so good. This is a big lesson from life to those who have an open mind to learn.

2007-09-15T20:00:00.000+10:00

If you are, like me, a heavy user of Microsoft Visual Studio 2005, chances are that you have experienced at some point a very slow application start. Once my visual studio 2005 was taking about 30 seconds just to load the interface.

After some good research, I could find a very interesting point: my visual studio was referencing a solution that I haven't worked in the last 8 months. Going deep on this, I saw this registry key:
HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\8.0\ProjectMRUList (MRU stands for "Most Recently Used")

If you have never touched this key via any regedit application, chances are that it is holding the last 20 projects you worked using VS 2005, and it does not matter how many are listed in your MRU list in your "File menu".

Why does Visual Studio 2005 saves the last 20 projects even thou I choose to save only the last 5 ones is still a a mistery.

So, happens that some of the solutions in my list were pointing to remote drives that I do not access anymore, thus creating this delay when loading Visual Studio.

To fix that I simply deleted the values for this key and it is all good now.

2007-09-13T23:56:00.001+10:00

Yes, this is something for us to think about. Even God reach out for the audacious ones.
Among the many lessons I have learn in this life, here it is a very important one: Face the reality, nobody will/can do anything for you unless yourself.

Every single thing you conquer in this life, is directly related to what you do or don't do. Nothing is sacred. Absolutely everything in this life can be changed for better or for worse at anytime you want.

Those who take ownership of their acts, those who assume the responsibilities of their actions are the real winners in this life. Winners face all the challenges, even during those times when there are no guarantees of success.

Based on that, I would like to share with you the one of the best declarations of self-love, self-esteem, conviction and willing to win I've seen in a long time: "The traditional way to face the outer space exploration has been to carry all the fuel needed to bring the astronauts back in case of an emergency or when something goes wrong; but in order to reach out further in the vast space, we must be audacious. This first audacious expedition team needs to travel to the Moon without the fuel to return back to Earth; So, they must be able to produce their necessary fuel there, on the Moon.
Sounds crazy, but we can do this in 7 years, and I intend to lead this expedition.
There was a time when people did audacious things to expand new frontiers. Unfortunately, as a whole, it seems that we forgot those days and how to do this. Today, we live in a moment where we need to be audacious again." - words from Bill Stone, Explorer.

When I saw this man talking about these things, I confess shivers crossed my spine. To get inside a space shuttle heading to the moon without the fuel to return?!!! That's crazy!

And once again, this brings back the idea of the fear and the risk. We need it to feel alive. Without it, we are just robots, or like plants in a jar.

In this world sometimes we are so full of ourselves, our cars, our dream houses, our status, our jobs and our titles, our fancy mobiles, our nice looking ties, our web systems with our strong passwords, that when someone comes out with such a simple concept and at the same time so unbearable, this one person breaks all the mediocrity, all the plastic convictions that we learn from the TV shows and shows us what is the reality of things.

The beauty of Bill's speech goes beyond the courage to risk. The beauty is that he is taking ownership of the risks and the challenges of it. He is being his own lab mouse. If someone have to risk anything for what I believe, let it be me; if someone have to die for anything I believe, let it be me; take your life according to your own convictions, never ask someone to do something that you would not do it yourself, do not explore others, do not bet on someone's head, do not step on nobody's toes, do not take advantage of the other's weaknesses; pay all your taxes, never ask someone to bring you a cup of water, stand up and go get it yourself; drink your own wine; use your own products; be the customer of your own company; challenge all the Gods, because if any of those Gods really exists, he/she would expect you to be fearless, audacious, untamed and not a couch potato with a remote control in one hand and a can of nutella in the other; This God would expect you to be unbearable, to see you in the unknown, in the darkness searching for a new light, breaking new grounds.

Yeah, you probably have heard something like:” it is being hard to bring my ideas from the paper to the reality". Pure non sense!! I've never met no one who haven't written his ideas on a paper and did not try them in a real life scenario; but in other hand, I know hundreds who never tried their own cool ideas simply because they never tried to write them down on paper first.

How would you know what to do, when to do, how to do, why to do, what comes first, what comes last, if you keep saving these ideas for yourself only?

I know...you are too busy, the projects consume too much of your time etc. but again, if you don't do it, who will do it for you? Stand up! get you own cup of coffee! Remember?

Are you ready to get on board on a travel to the unknown and find your way out once there? Remember, you have only this life to try it. Do your best. Think about it.

See you all.

24
http://j.mp/d7wcpk

http://j.mp/9uKRB4

26

http://j.mp/9ybXHU

http://j.mp/cSz6kJ

2007-09-07T01:07:00.000+10:00

Dear friends, today Apple released to the market the brand new iPod. Speaking of business, the iPod is such a extraordinary creation that no one could see it coming a few year ago and reaching the levels they are today and its relevance in the world market. The iPod created a brand new market for itself, and its market share is just amazing. To have an iPod today is to have status. Apple really did it, again.

But not always was like that. So let me tell you a story.

---- --- -- -

The year was 1997. Steve Jobs, who was previously fired from the company he created with a friend, was called back to Apple with a mission to rescue the company from the certain death. Once he got there, one of the first things he did, he fired the company who used to produce Apple's marketing campaigns and immediately put up Apple's marketing account up for grabs.

Mr. Jon Steel, owner of one of the agencies crazy to get such a big client, remember the exact moment when he met Jobs. According to his words, it was something like that:

"Me and my partner were almost 2 hours inside this huge meeting room with 2 others Apple's executives. Then Jobs came in. He literally broke the amazingly boring presentation we were watching. Those 2 guys were doing a presentation about Apple's history, profile, the "win-win" ideology, the key factors for success inside the company, Apple's vast portfolio, investment plans, yada yada yada.

Jobs briefly greeted us and then came straight away, without even turning his head towards the actual Apple's executives. He said:

- I am 100% sure this beautiful talk that you guys just heard from the "dynamic duo" here is all crap. So, here is the deal: The Apple is about to break. We are going for bankruptcy! but I believe that if we can make 2 or 3 things very well done, things with world class appeal, we will manage our way out of this. During the last days I rejected 11 projects that were presented to me, only 2 were left: called G4 and iMac. For me, they are the ONLY projects capable to represent what we want this company to become: Technologically superb, visually fantastic. And I will bet Apple's future on them.

We left the meeting with all the ideas from Jobs himself. A few days later, we got the news that the "dynamic duo" had been fired later that same day.”

---- --- -- -

Well, my point is. What is marketing for you? Let's call this case the "Marketing 1.0". Until mid-90s, that was the kind of marketing that trashed companies around the world, with those companies mission statements, with empty messages, boring...but very well formatted. Nowadays, this marketing does not deserve any of our attention anymore.

Sometimes I think some "marketing people" are trying to make a "cartel", a "gang". This gang would be made of their cool-other-marketing-creative-friends-from-other-companies, they create large campaigns based on repetition-repetition-repetition-repetition of the same campaigns of the past, just because there is a saying in this niche: You have to publish 10 times the same campaign, so the client will pay attention to the message. Just like those crazy rug sellers on the TV screaming every 0.5 seconds the prices out loud, treating us at home as deaf or blind consumers.

I say, that's rubbish! We can do better than this! They MUST do better than this!

That's why the Marketing 2.0 is coming powerful in the Internet age. Now, you can see very funny, creative, innovative campaigns from the Internet itself. And guess who created them? teenagers, retired people, even people who never worked with marketing before. The media revolution gave them power so other can see and tell: Hey, those guys are really cool! And they never went to those marketing schools to learn those same-same marketing laws.

Right now, the main problem of the Marketing 2.0 is the ROI, or the lack of it. It still does not have metrics, it still does not give us better "leads" for new businesses, they still do not have a strategy to align the field vendors and the employees using several communication pipes online and offline.

And that's going to be just a matter of time, and then one day those guys and this new marketing era will be able to predict entire product forecasts and compose projects budgets with efficiency. And in a new way!

The marketing 1.0 will be dead then; and with it, those who were not able to pick up the pace.

If you are a marketeer, and you like your job, think about it. What would Jobs tell about you in your next PowerPoint presentation? Would he interrupt you ? Would he support you?

And then, comes the Demand 2.0.

We should concentrate our business efforts in the clients, but those with the highest chances to turn from formal proposals to real contracts. To real money. Use the marketing 2.0 to collect, Analise the market and then create customized approaches. Now, speak clearly what is the BEST reason why this client would want to make business with you or to buy your product. When talking to the bosses, be straight, be business-oriented, goal-oriented. Stop selling only for your regular buyer.

Discover what does the client wants, what other problems they have. Attack them! Now share those ideas with those who can help to find a solution. Which bring another point: surround yourself of good people. good soldiers. DON'T LET THEM GO to another company.

Transform your website in a portal that educates the visitor about how you can help them, what solutions do you have, what problems can you solve. Place there you most successful cases. Make a blog. Let others now that your company is a good one for work, in an open-shared environment where ideas flow.

Start selling your product before the client is ready to buy!

Yes, the end of the Marketing 1.0 is near and it is coming. Throw away the old myths, open space for the new. The Marketing 2.0 is right here, right now.

Let's share ideas. I can share mine with you as well. If you don't share, how would we exchange and grow? if not here, where? if not now, when?

Think about it. See you guys later.