This post explains nicely why i just deleted every web in my whole site collection.

Basically OpenWeb() with no parameter passed will return the first valid web in the URL string passed to open the SPSite object! So it kept walking up the hierarchy, returning every level to my recursive delete function.

Ah well, at least it wasn’t production….

Web developers throughout the land rejoice! The long overdue beginning of the end…

Quick overview of HTTModule and HTTPHandler can be found here.

The benefits of using HTTPModules

A HTTPModule works well with 3rd party products as you do not have access to the source code and / or you are not able to change core files. You need some other way of hooking into the page event lifecycle. Of course there are many available ways of doing this already (Event Hooks, SharePoint Event Handlers, etc.) but sometimes these just don’t cut it.

See below for examples.

Example 1 – Custom Authorization Provider for SharePoint 2010

I’m working on a project where SharePoint will be a repository for storing wiki & blog sites and a few other web based structures, while the main application itself exists independent of SharePoint. This app has it’s own custom Authentication and Authorization processes which store all user session data in a custom database.

The Authentication piece of this is very interesting too as we are using a custom Claims Provider for SharePoint 2010 but that’s another blog post.

For the Authorization piece, we need a way to intercept each page request to the SharePoint environment and verify that the user has sufficient permissions to access this resource. Obviously, we don’t want to have to make this webservice call for each page request (or fractions of pages – some SharePoint pages i have seen can make over 30 separate authorization calls for different page controls on first load!!) so we need a way to verify user access level initially and then cache this for a period.

The initial road i went down here was to produce our own custom ‘AccessDenied.aspx’ page which all users would automatically reach if they attempt to access a resource they do not have permissions to. This worked really well as we could wait for the pipeline to finish processing and intercept the process at the very end when we were sure the auth had failed.

The problem with this is you can’t touch SharePoint default files. MS get very cross on support calls if you dare and tell you to go away until you put the system back the way it was. So i can’t hack into the ‘accessdenied’ page

This is where the HTTPModule came in. I initially thought I could jump in at the ‘AuthorizeRequest’ event of every page call so i could provide seamless authorization to the user. But because of the number of times this would be called (not just for pages but for page elements), I was very concerned about the detrimental effect this code might have on overall load times. I settled on combining both earlier ideas -  I can detect when the context URL contains ‘/_layouts/accessdenied.aspx’, insert some custom code for these requests only then redirect if the user passes our auth check!

Authorization Caching

The solution to the user auth caching is to add the user to the relevant SharePoint group with access level set, but in tandem, write a secure cookie (encrypted using machine key of server) to the client machine which has a hard expiration of 20 minutes (hard expiration to stop hackers indefinitely extending the life of a sliding session by maintaining an open connection by periodically pinging server).

Example 2 – Override Core SharePoint JavaScript functions

The majority of SharePoint’s javascript is called from a file called ‘core.js’ which is included in the MasterPages as a script link. The MS recommended approach is to create a custom Master page and change this link, but what if the page you want to modify is also a core SharePoint file (in this case ‘versions.aspx) and you can’t touch it to change the Master Page link? HTTPModule again! Detect this URL and forward the user on to your version of this page which calls the customised javascript file. Et voila.

Of course it’s never that simple – i had a lot of messing to do with relative URLs to get it to work but the principal is there.

Downsides to using HTTPModules

As the HTTPModule code will be called for every request through the page pipeline, poorly designed code can have a massive effect on performance. Think very carefully about what extra processing you are adding before doing it.

I had added a linked server instance using the following command:

EXEC master.dbo.sp_addlinkedserver @server = N’<remoteserverinstancename>’, @srvproduct=N’SQL Server’

This seemed ok – i could connect to the remote master database ok:

SELECT COUNT(*) FROM [<remoteserverinstancename>].[master].[sys].[tables]

But trying to run a query against any other database failed with this error:

Named Pipes Provider: Could not open a connection to SQL Server [53]

The way i finally solved this (none of the swathe of MSDN articles related to this helped me), was to:

1) Create a local SQL user account (Windows accounts don’t seem to work) on the server to connect to, called something like: ‘<servername>_linked_server_user’ with a specified password.

2) Grant this user permissions on the database i want to connect to.

3) Update the Linked server connection on the server which runs the query through the GUI; update the security properties to make all connections use this security context as shown:

Quick test:

Run the query:

‘SELECT top 10 * FROM [<remoteserverinstancename>].[<databaseToConnectTo>].[dbo].[<tableToConnectTo>]’

and see if it works.

If a SharePoint site has to be branded but is not required to meet any accessibility standard, the next consideration is whether the proposed branding style is radically different from the default look of SharePoint (or any of its associated built-in styles).

If the branding is exactly the same except for a change of colour, a new site theme should be created or an existing theme should be copied and modified.

If there are small structure and colour changes required to a built-in style for a SharePoint, the built-in SharePoint style should be copied and modified.

If the branding of the proposed SharePoint site is quite different from any of the built-in styles, a new branding will have to be created from scratch.

An example of changes that would qualify as regarding a complete build of master pages would be a custom navigation menu.

General considerations when creating a completely new branding for SharePoint

If the design of the site is going to be radically different from built-in SharePoint sites, the best practice is to create static web pages of the site design. This is the case for both accessible and non-accessible site designs.

The static pages should work well across a variety of browsers and pass accessibility testing if this is a requirement for the final SharePoint branding. This task of creating the static web pages could be done by an external party such as a web design agency. There are guidelines that should be followed when creating static pages for a branding for SharePoint that are outside the scope of this document.

Once these static pages have been created, these static pages will need to be cut up into separate ASP.NET files that SharePoint will use as the layout. This is a developer task.

Custom development of code and website files are also required when creating a new SharePoint branding.

Sites with accessibility requirements will require a lot more coding than those without. The development required really depends on the requirements of the site content.

SharePoint Designer

SharePoint designer is a free programme from Microsoft that can be used to customize the appearance of SharePoint whether it is WSS only or MOSS. Although some parts of the designer may be useful such as the workflow wizard, it is not suitable for any significant branding of SharePoint.

Accessibility standards overview

Website accessibility standards are specified by the Web Accessibility Initiative (WAI) which is a sub group of the W3C. The most common accessibility level to aim for is Double-A.

The main goals to achieve Double-A conformance is to produce clean HTML where the layout is controlled by CSS.

Aside from producing reasonably clean HTML, other considerations for accessible sites include providing:

• alternate text for images
• alternate content for media such as flash or navigation that depends on JavaScript
• meaningful titles for links on the page

Some of the standards for accessibility are the responsibility of the content editor such as providing alternate means of accessing content.

There are programs such as Total Validator which can automatically validate a web page against an accessibility level.

With MOSS 2007 the following can be achieved:

• Colour scheme changes
• Major layout and appearance changes, making the site unrecognisable as a SharePoint
• Sites that conform to accessibility guidelines (though not without considerable effort)

The first consideration when branding a MOSS sites is whether the site has to conform to accessibility guidelines.

By default, SharePoint does not come close to conforming to accessibility guidelines but it can be re-worked with a variety of techniques to produce accessible content with (at least) 3 caveats.

These caveats are:

• Accessibility can only be achieved when a user is accessing a site in a read-only style mode
• Many advanced features of SharePoint cannot be used. These include:
  • Almost all web parts
  • Web part zones (a type of layout that allows flexibility in placement of modules)
  • Built-in brandings and themes that come with SharePoint
  • The default content editor
• It takes lots of work! Custom development is almost certainly required.

The NSU Safe network site is an example of a SharePoint site that conforms to Double-A compliancy.

There are 2 notable frameworks that have been created to assist with making SharePoint accessible.

The Accessibility Kit for SharePoint (AKS)

There is an accessibility framework produced by a HiSoft in association with Microsoft. The framework is currently at version 2.0 at this time.

The kit includes more accessible versions of the built-in SharePoint themes and layouts though using any of these is a token gesture towards accessibility.

From investigation, a lot of development is still required to create an accessible site and the AKS does not provide much help towards this.

The Alternative Rendering Framework (ARF)

ARF is an open source framework to assist with creating accessible SharePoint sites. One of the core concepts of the framework is to keep using SharePoint lists and document libraries as the data store for a site but providing an alternative method for customizing the display of this data.

The ARF has proved very useful for creating accessible sites is used in the NSU Safe Network site.

When there is a requirement to customise the appearance of a SharePoint site, the first consideration is the version being used.

Branding WSS sites

If the SharePoint version is WSS (free to install if you have Windows Server 2003), colour and image changes are possible along with minor layout changes. It is not possible to use WSS to produce an accessible SharePoint site.

The default theme of SharePoint looks like the following

Other built-in themes that have different colours and images only are available

Microsoft released 10 new themes for SharePoint in March 2009 and one of these could be used. Again, the structure of the site is the same and only colour and images have changed.

• Team sites now have a pages library
• Wiki linking is built into pages. You can now wiki link to pages, lists, items and docs
• Silverlight is built-in to SharePoint’s ‘Create’ dialog. Apparently SL can be made accessible. Not sure if this is the case with this Silverlight dialog. Need to check accessibility
• Pages check for changes every minute and auto save if you have made any.
• Built-in Rich Text Editor has multiple levels of undo
• Versioning is on by default.
• New master pages exist. v4 is the latest. Changes here are carried through to site settings pages. Also have a minimal (no ribbon), simple (for error pages) and default (legacy)
• Accessibility is covered by everything being AA and XHTML. Not sure if this applies to central admin though.
• Text editors all render to XHTML
• You can add buttons to the SP Ribbon. I tried this and it’s a nightmare….
• You can associate more forms with lists, rather than New, Edit & Display. This includes InfoPath forms. Done through SPD
• XLSTViewWebPart is used for all list data now. More efficient and custom XSL can be supplied.
• Ajax settings can be configured on lists, i.e. refresh interval, manual refresh button, enable/disable Ajax etc.
• Lists can support inline editing (enabled in SPD) and a rating column (think star’s *****) , although InfoPath doesn’t support the latter in it’s designer.
• 2 versions of InfoPath are being banded about, a designer and a ‘Filler’
• A new post processing synchronous event now exists for lists that can be used to give feedback to a user after an item has been added.
• Cancelled events can redirect to a custom page that displays within a SP Modal Dialog
• Event submitters can be determined. In WSS sometimes the event owner would be assigned to a workflow/system account. MSF holds details on who raised what event.
• Built-in SP Explorer doesn’t expose bound list events. This is poor. No visibility if a list has 34 events already bound to it.
• Lists now support referential integrity (master detail) and cascading deletes.
• List joins can be made through queries (join up to 6 lists). Limit of 800kb for return results
• Projected fields now exist within lists, i.e. on a child list display a field from the parent, i.e. parent:company name
• MSF (Microsoft SharePoint Foundation) now supports 50m list items
• Throttling available from central admin for list queries. Can be time based (i.e. only allow this quota between 9-5pm). Settings available to allow/deny overrides via the object model. Administrator has a lot of control on query results.
• Unique column constraints available on column types. Company name can be made unique. Requires indexing and depends on SQL Collation
• Linq To SharePoint removes CAML Pain, but you need to generate SP Class Entities via a tool in the 14 hive called SP Metal. Basically point SP Metal at your SP Site and it generates a load of strongly typed C# classes.
• Lists are still stored as STP files, despite site templates being converted to WSP’s.
• Columns now have validation. Syntax similar to Excel, i.e. [CompanyEmployees] >= 50

Client Object Model

• Consistent interface across .NET, Silverlight, Javascript. Same (to a degree) method names. Obviously some differences in type support, i.e. JS’s NAN
• ‘Client Context’ used to batch operations
• All communications go through a client.svc WCF Service
• Requests appear to be sent as XML, responses as JSON
• New Silverlight webpart. XAP files deployed to webparts folder. XAP file is simple a zip for cross platform operation
• LINQ To SP not provided within Silverlight. ADO.NET Data services used instead
• Uploading an office theme for use in SP2010 doesnt work in this beta.
• SharePoint ‘Web application service’ service under central admin is used to sync your WFE servers. It’s dangerous though because it starts deleting your IIS files when you stop it. It will recreate them when restarting but any web.config changes etc you’ve made are gone

Workflows

• Workflows can now run against a site & list items. Event handlers needed to initialise
• Workflows can listen to notifications from external systems before resuming excution. Uses EDE (external data exchange). Long winded and complicated process
• Workflows can now be added & deployed via the new Feature packager
• Workflows can be created in Visio, exported to SPD and then again brought into VS2010. You can move between Visio & SPD easy enough but it seems that when it enters VS2010 it can’t be exported again to the others
• No version control in SPD other than SP2010’s list version control.
• New workflow events (started, completed)
• New visio web plugin displays visually the workflow path. It’s ok. Doesnt center workflow properly on load. Bit like page viewer web part
• SSP is gone, replaced by Service Providers. These can be load balanced & moved across servers as required.
• New Word automation service can be used to convert docs to PDF, Word 2003 etc. Word Open XML SDK intended for doc manipulation. Will still need Aspose.Net for Word 2003 docs
• Developers can create their own Service Providers. Looks reasonably complicated. Specific usage scenarios, i.e. intense calculations etc

BCS

• BCS is the new BDC
• Entities are now ECT’s, External Content Types
• BCS is now supports read/write to external systems
• SPD used quite well to create connections and CRUD screens
• SP2010 now has external lists that can expose data from external systems. Appears that workflows now support for these list types
• SSO details now stored in new Secure Store Service
• Groove (SP Workspace) seemed decent enough. Change I made in Groove went back to SP2010 and then on out to external system (SQL DB)

ECM

• Folders now supported in Page Libraries
• new content deployment option ’snapshot’. Time based snapshot sent between servers. Requires Enterprise SQL ‘05 or ‘08.
• New web analytics & reports. Looked ok but definitely not google contenders. Didn’t appear to be a means to export
• End users can now tag metadata to content themselves in addition to standard method
  Record management now possible ‘outside’ record center
• New ‘Unique Document Id’ service. Every document given a unique ID. Stays with it even if moved. Apparently has limited configuration options. This ID when used in conjunction with a specific URL (by sticking the ID on the query string) will take people to the document regardless if it is moved within the same document library or across libraries within a site collection
• Hold actions no longer tied to record center
• New document set. Content type composed on sub content types. ‘Document Set’ feature needed to be activated for it to work.
• Doc sets have versions and workflows can be run against them and constituents. Possible use is WF to check that all docs have been completed before moving to next stage.

Search

• 3 Levels of Search for SP Foundation Server
  • • Basic – Search Server Express 2010
    • Intermediate – SharePoint search 2010 (Index outside SP & Filestores)
    • Advanced – FAST can accept ‘push’ updates from code
• JDBC Support now included
• SP2010 has search connectors for Exchange, Notes, Documentum, FileNet, Opentext & custom .NET connector
• Support for search attachments
• Search web parts now unsealed. Can be overridden.
• New ability to override a query before its executed and results before display to users
• Search can have multiple levels of ranking models. Can be manipulated via PowerShell

BI

• BI Includes status indicators (as before, i.e. red amber green), chart web part, Performance Point Services, Excel Services, BI Search, Visio Services (Visual representation of KPI’s in Visio)
• Reporting Services doesn’t ship with 2010. Separate download
• BI Search adds Excel & Reporting services to search. Search for ‘delivery’ & spreadsheets with query are returned & filtered on query
• BI Centre template – Starting point with BI Portals
• New server product ‘Gemini’ provides in memory olap manipulation. Seamless for developers, no need to touch it.
• Little change is PerformancePoint Services
• Office Excel Web app looks decent.

Sandbox Solutions

• Site collection owners have power to deploy WSP’s to the sites sandbox, which is called ’solution gallery’
  Sandbox basically uses a cut down SP2010 Object model.
• Code executes in a separate process ‘Microsoft SharePoint Foundation User Code Service’
• A validation framework exists that can scan & validate wsp’s that are uploaded to the sandbox. Validators can revoke permission for the wsp to execute
• Sandboxed solutions are isolated to their own site collection.
  Two versions of the Microsoft.SharePoint.dll exist. The full version and the subset.
• When you create a new VS2010 project, you’re prompted if you want full trust of sandbox. If you select sandbox it ’still’ uses the full dll. No compile time checking that you should be using a restricted sharepoint dll.
• Sandbox apps use quotas. These are configurable and cover a varied number of scenarios such as process memory, db calls etc. For example, 20 db calls = 1 resource point. It you hit the max quote your web part/code is halted by SharePoint
• A timer job resets quotas at the end of the day.
• Doesn’t appear to be a means to determine what caused your quota to max out
• Quotas set via central admin or powershell
• I feel that setting quotas could be a dark art. Users * web parts * queries/cpu executions etc
• No means to promote from sandbox to live. Would require a removal & redeployment
• At runtime, sandbox wsps are retrieved from the solution gallery. Any required dll’s are extracted to a temp folder, loaded into memory and immediately deleted.
• It doesn’t look like you can debug sandboxed apps. There’s A) no place for PDB files and B) the user code service is a SP Service under central admin. No way to attach to it as far as I can see.
• Sandboxed apps can be load balanced

I needed to get the value from a field called ‘Company’, but when I tried to get the value for Company through my code it brought back the value for the field ‘Position’.

In my case, I found out this was because these where not the original field names. In SharePoint a field has an internal name. This internal name of a field is set to the fields title when it is originally created and never changes.

There is an easy way to find a field’s internal name without resorting to code. If you sort a list by a field, the url will contain the fields internal name as the ‘SortField’ Parameter.

When I sorted the list by ‘Company’ I found it had an internal name of ‘Linktitle’:

http://…/All%20Open%20Items.aspx?SortField=LinkTitle&SortDir=Asc

and when I sorted by Position:

http://…/All%20Open%20Items.aspx?SortField=Company&SortDir=Asc

This explains why the code was returning the Position and not the Company.

I changed the code to pick up the value of field ‘LinkTitle’ and everything now works fine.

I have been recently working on a simple enough Timer job. The timer job runs once a day and checks a date field for every item within a list.

if the checked items date is the same as the current date, a notification email is sent to the user who owns / created the item. As I said, simple.

Unfortunately I found out the Timer job runs twice in quick succession instead of once. I thought I must have activated it twice in the code, but after much debugging I found that It had only been deployed and activated once.

Eventually I found that the problem was being caused by a property called SPJobLockType.

This property defines how the instance of a timer job runs.

The value set in the timer job was SPJobLockType.ContentDatabase. This value causes the timer job to be run once for every content database on the farm. We have 2 content databases on the farm, therefore the job was running twice.

I changed the value to SPJobLockType.Job. This locks the job and doesn’t allow it to run more than once on a server and solved my problem.