tryanDLS
11-22-2006, 01:52 PM
Jack,
I was looking at the HTML output for a grid and I see that spans are built for cols that are tagged as hidden in the CM. I can see the need for this in order to provide something like a rowId for client manipulation, but I'm thinking maybe there should be another option here - maybe 'Ignore'. This would completely skip rendering the column. From a security perspective there could be data that's in a dataset that shouldn't be output to the client at all. The ideal situation would be yo not send those columns, but if you're working with a dataset that you don't control, that's not always the case. It still wouldn't be ideal b/c you could still see the actual data via the debugger, but at least you would not add nodes to the DOM that aren't going to be seen. I could see this being a big deal in cases where a big dataset (# of columns) is retrieved, but it's displayed in multiple gridViews that only show a subset of the columns.
I was looking at the HTML output for a grid and I see that spans are built for cols that are tagged as hidden in the CM. I can see the need for this in order to provide something like a rowId for client manipulation, but I'm thinking maybe there should be another option here - maybe 'Ignore'. This would completely skip rendering the column. From a security perspective there could be data that's in a dataset that shouldn't be output to the client at all. The ideal situation would be yo not send those columns, but if you're working with a dataset that you don't control, that's not always the case. It still wouldn't be ideal b/c you could still see the actual data via the debugger, but at least you would not add nodes to the DOM that aren't going to be seen. I could see this being a big deal in cases where a big dataset (# of columns) is retrieved, but it's displayed in multiple gridViews that only show a subset of the columns.