After June 2011 CU custom Application Pages produce exceptions RRS feed

  • Question

  • Hi,

    we recently applied the June 2011 Cumulative Update and had the February 2011 CU before that.

    Since we installed the June CU all our custom application pages (e.g. an ASP.NET page that opens when you click on "New" in a SharePoint list) throw the following exception when doing any kind of postback (no submit, just a "normal" postback e.g. to switch to the edit mode in an ASP.NET ListView) directly after the completion of the Page_Load method.

    Exception: Microsoft.SharePoint.SPException
    The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.
      at Microsoft.SharePoint.Library.SPRequest.ValidateFormDigest(String bstrUrl, String bstrListName) 
      at Microsoft.SharePoint.SPWeb.ValidateFormDigest() 
      at Microsoft.SharePoint.Utilities.SPUtility.ValidateFormDigest() 
      at Microsoft.SharePoint.WebControls.EntityEditor.OnLoad(EventArgs e) 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Control.LoadRecursive() 
      at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) 
    Inner Exception 1:
    Exception: System.Runtime.InteropServices.COMException
    The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.
      at Microsoft.SharePoint.Library.SPRequestInternalClass.ValidateFormDigest(String bstrUrl, String bstrListName) 
      at Microsoft.SharePoint.Library.SPRequest.ValidateFormDigest(String bstrUrl, String bstrListName)

    Normally this exception indicates that you forgot to set SPWeb.AllowUnsafeUpdates = true somewhere in your code...but this was workng before installing the June CU, so I was wondering if anyone else has the same issue?



    P.S.: This post could also belong to the developer forum...but as it is linked to installing the June CU, I thought it might belong here. Please move it if you think it might belong there :-)

    Tuesday, July 5, 2011 11:57 AM


All replies

  • The forum is OK but please - as there are those CUs for all 2007 and 2010 SP products, please do confirm that your question is about MOSS 2007 and say whether you also applied (beforehand) the equivalent WSS 3.0 CUs.


    SP 2010 "FAQ" (mainly useful links): http://wssv4faq.mindsharp.com/default.aspx
    WSS3/MOSS FAQ (FAQ and Links) http://wssv3faq.mindsharp.com/default.aspx
    Both also have links to extensive book lists and to (free) on-line chapters
    Tuesday, July 5, 2011 1:47 PM
  • Thanks for the good hint Mike :-)

    We've got MOSS 2007 Enterprise 32-bit and we installed the WSS 3.0 first and then the MOSS 2007 updates.

    Luckily we found the exceptions on our development servers first (tested it on 3 different servers), so this is a single server installation with AD, SQL Server and SharePoint on one server.

    Tuesday, July 5, 2011 1:59 PM
  • Hi,

    I have the same problem  and I solved it by using FormDigits http://msdn.microsoft.com/en-us/library/ms472879.aspx

    After that I had another Problem:

    I use a Sharepoint PeoplePicker on my ASP-site. Performing a second postback the site crashes with the following error:

    Message: String was not recognized as a valid Boolean.

    at System.Boolean.Parse(String value)
    at Microsoft.SharePoint.WebControls.EntityEditor.ParseSpanData(String spans) 
    at Microsoft.SharePoint.WebControls.EntityEditor.LoadPostData(String postDataKey, NameValueCollection values) 
    at System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad) 
    at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

    As you see the error occures in the Method "ParseSpanData". The only boolean attribute there is the "isresolved". Controlling the rendered page I realised that it differs in the "HiddenSpanData".

    Here are the hidden span data after initial rendering of the site:

    <span id='spanVMDEV\pm' tabindex='-1' contentEditable='false' class='ms-entity-resolved' title='VMDEV\pm'><div style='display:none;' id='divEntityData' key='VMDEV\pm' displaytext='PM' isresolved='True' description='VMDEV\pm'><div data='&amp;lt;ArrayOfDictionaryEntry xmlns:xsi=&amp;quot;http://www.w3.org/2001/XMLSchema-instance&amp;quot; xmlns:xsd=&amp;quot;http://www.w3.org/2001/XMLSchema&amp;quot;&amp;gt;&amp;lt;DictionaryEntry&amp;gt;&amp;lt;Key xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;DisplayName&amp;lt;/Key&amp;gt;&amp;lt;Value xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;PM&amp;lt;/Value&amp;gt;&amp;lt;/DictionaryEntry&amp;gt;&amp;lt;DictionaryEntry&amp;gt;&amp;lt;Key xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;Email&amp;lt;/Key&amp;gt;&amp;lt;Value xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;PM@vmdev.local&amp;lt;/Value&amp;gt;&amp;lt;/DictionaryEntry&amp;gt;&amp;lt;DictionaryEntry&amp;gt;&amp;lt;Key xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;SPUserID&amp;lt;/Key&amp;gt;&amp;lt;Value xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;30&amp;lt;/Value&amp;gt;&amp;lt;/DictionaryEntry&amp;gt;&amp;lt;DictionaryEntry&amp;gt;&amp;lt;Key xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;PrincipalType&amp;lt;/Key&amp;gt;&amp;lt;Value xsi:type=&amp;quot;xsd:string&amp;quot;&amp;gt;User&amp;lt;/Value&amp;gt;&amp;lt;/DictionaryEntry&amp;gt;&amp;lt;/ArrayOfDictionaryEntry&amp;gt;'></div></div><span id='content' tabindex='-1' contenteditable onMouseDown='onMouseDownRw();' onContextMenu='onContextMenuSpnRw();' >PM</span></span>

    and here the hidden span data of the site rendered after a postback:

    <SPAN id=spanVMDEV\pm class=ms-entity-resolved title=VMDEV\pm tabIndex=-1 contentEditable=false><DIV style=&quot;DISPLAY: none&quot; id=divEntityData description=&quot;VMDEV\pm&quot; isresolved=&quot;True&quot; displaytext=&quot;PM&quot; key=&quot;VMDEV\pm&quot;><DIV data='<ArrayOfDictionaryEntry xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xmlns:xsd=&quot;http://www.w3.org/2001/XMLSchema&quot;><DictionaryEntry><Key xsi:type=&quot;xsd:string&quot;>DisplayName</Key><Value xsi:type=&quot;xsd:string&quot;>PM</Value></DictionaryEntry><DictionaryEntry><Key xsi:type=&quot;xsd:string&quot;>Email</Key><Value xsi:type=&quot;xsd:string&quot;>PM@vmdev.local</Value></DictionaryEntry><DictionaryEntry><Key xsi:type=&quot;xsd:string&quot;>SPUserID</Key><Value xsi:type=&quot;xsd:string&quot;>30</Value></DictionaryEntry><DictionaryEntry><Key xsi:type=&quot;xsd:string&quot;>PrincipalType</Key><Value xsi:type=&quot;xsd:string&quot;>User</Value></DictionaryEntry></ArrayOfDictionaryEntry>'></DIV></DIV><SPAN id=content oncontextmenu=onContextMenuSpnRw(); tabIndex=-1 contentEditable=true onmousedown=onMouseDownRw();>PM</SPAN></SPAN>

    With these hidden span data the method "ParseSpanData" gets a parameter like this:

    <SPAN id=spanVMDEV\pm class=ms-entity-resolved title=VMDEV\pm><DIV style="DISPLAY: none" id=divEntityData><DIV></DIV></DIV><SPAN id=content>PM</SPAN></SPAN>

    which doesn´t contain an attriute called "isresolved" which causes the crash.

    The question now is: What can be done to render the PeopleEditor correct.





    Friday, July 8, 2011 8:42 AM
  • I am having this exact same issue after installing the CU but it manifests itself only when adding a link to the smmary link web part (something I did not test ahead of time).  Turning off security validation on the web application will solve it but that is just plain stupid.  I can also reproduce this in all my environments.  We do have the form digest in our masterpage and I also checked that it was in the application.master so I am not sure what the problem is.
    Thursday, July 14, 2011 5:16 PM
  • I was able to fix this error by adding this code to the bottom of layouts/dialog.master (this isn't in the page before the update either):


      <asp:ContentPlaceHolder ID="PlaceHolderFormDigest" runat="server">
        <SharePoint:FormDigest ID="FormDigest1" runat="server" />

    I also opened a case with MS and they were also able to reproduce the issue on their end.  I will post back here if I get a resolution from them.

    • Proposed as answer by R_Hedges Wednesday, August 31, 2011 8:52 PM
    Thursday, July 14, 2011 6:35 PM
  • We are having the same problem with our site. We just install the CU for June. The error occurs when we try to add something the My Links.  We get "The security validation for this page is invalid. Click back in your Web browser, refresh the page, and try your operation again. at microsoft.SharePoint.Library.SPRequestInternalClass.ValidateFormDigest(String bstrUrl, String bstrListName) at Microsoft.SharePoint.Library.SPRequest.ValidateFormDigest(String bstrUrl, String bstrListName)
    Monday, July 18, 2011 4:40 PM
  • We have the same problem here in our environment. It happens on our branded pages. But also tested on the default sharepoint masterpage with a standard article page with 1 web part zone.
    Monday, July 25, 2011 2:31 PM
  • A big thanks to Jason Kuter for that workaround. That has kept us going for the time being.

    I would be very interested to hear the response from Microsoft when it comes back.

    Friday, August 5, 2011 4:32 AM
  • I am also interested in how to get this issue corrected.  I am currently seeing the issue when attempting to modify my MOSS 2007 site navigation.  I can select the link to edit, enter the new URL, but received the "security validation" error when I click OK to save my changes.  My guess is that I will run into the issue elsewhere, too.  This has only begun happening since installing the June CU.
    Friday, August 5, 2011 4:53 PM
  • Hi again,

    my initial problem was solved by adding the SharePoint FormDigest Control to the page. Now I get the error Christian is having.

    So to summarize it with my own words:
    We installed the SharePoint 2007 June 2011 CU and got the Exception from my initial post "The security validation for this page is invalid...". This was fixed by adding a FormDigest Control to the page.

    Now I get the following Exception on the second postback, but only on a SharePoint installation with the June 2011 CU. With the February 2011 CU I don't get this Exception.
    There are also some other people that seem to have a similar problem with several 2010 versions of SharePoint and Project Server as well as 2007.

    Exception: System.FormatException
    String was not recognized as a valid Boolean.
     at System.Boolean.Parse(String value)
     at Microsoft.SharePoint.WebControls.EntityEditor.ParseSpanData(String spans)
     at Microsoft.SharePoint.WebControls.EntityEditor.LoadPostData(String postDataKey, NameValueCollection values)
     at System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad)
     at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

    I disassembled the two different dll versions (with and without the June 2011 CU) containing the EntityEditor class and you clearly see the following two differences.

    1. In the June CU the following EntityEditor.OnLoad method was added, which does not exist in the version without the June CU:
      [SharePointPermission(SecurityAction.Demand, ObjectModel=true)]
      protected override void OnLoad(EventArgs e)
      	if (this.Page.IsPostBack)
      		while (!SPUtility.ValidateFormDigest())
      			throw new SPException(SPResource.GetString("PageSecurityValidationFailed", new object[0]));
    2. In the EntityEditor.ParseSpanData method which is producing the Exception I found a lot of changes.

    As I was not sure if those differences are really the root cause of the issue, I tried to find out where in the code it is throwing the Exception and this is what I found.
    The only place in the EntityEditor.ParseSpanData method where a bool is parsed is in the following line:
    bool.Parse(GetAttribute("isresolved", input));

    There the property "isresolved" is read from the PeopleEditor's span data.
    So I took the time to compare the resulting html code in the following way and found some more differences (and maybe the root cause for the Exception):

    For both versions (with and without June CU) I copied the html source directly after loading the form and after the first postback (so I got four source files) and compared the section which contains a people editor where a person was already selected.

    Two differences caught my eye (and they are most likely causing the issue):
    1. In the two source files with June CU and in the source file without June CU after initial loading I found the following <div>, which is missing completely in the source file with June CU after the postback:
      <DIV style="DISPLAY: none" id=divEntityData description="VMDEV\localadmin" isresolved="True" displaytext="Default Admin Account" key="VMDEV\localadmin">
    2. In all source files I found the following <INPUT>, but in the source file with June CU after the postback it only contains an empty <Entities/> entry:
      <INPUT id=GIControl_GeneralInfoControlView_peProjectManager_OriginalEntities value='<br/><Entities><br/>  <Entity Key="VMDEV\localadmin" DisplayText="Default Admin Account" IsResolved="True" Description="VMDEV\localadmin"><br/>    <ExtraData><br/> <ArrayOfDictionaryEntry xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" rel="nofollow">http://www.w3.org/2001/XMLSchema-instance</a>" xmlns:xsd="<a href="http://www.w3.org/2001/XMLSchema" rel="nofollow">http://www.w3.org/2001/XMLSchema</a>"><br/>          <DictionaryEntry><br/>            <Key xsi:type="xsd:string">DisplayName</Key><br/>            <Value xsi:type="xsd:string">Default Admin Account</Value><br/>          </DictionaryEntry><br/>          <DictionaryEntry><br/>            <Key xsi:type="xsd:string">Email</Key><br/>            <Value xsi:type="xsd:string">localadmin@vmdev.local</Value><br/>          </DictionaryEntry><br/>          <DictionaryEntry><br/>            <Key xsi:type="xsd:string">SPUserID</Key><br/>            <Value xsi:type="xsd:string">1</Value><br/>          </DictionaryEntry><br/>          <DictionaryEntry><br/>            <Key xsi:type="xsd:string">PrincipalType</Key><br/>            <Value xsi:type="xsd:string">User</Value><br/>          </DictionaryEntry><br/>        </ArrayOfDictionaryEntry><br/>    </ExtraData><br/>  </Entity><br/></Entities>'<br/>type=hidden name=GIControl$GeneralInfoControlView$peProjectManager$OriginalEntities>

      Compared to:
      <INPUT id=GIControl_GeneralInfoControlView_peProjectManager_OriginalEntities <strong>value="<Entities />" </strong>
      type=hidden name=GIControl$GeneralInfoControlView$peProjectManager$OriginalEntities>

    So it seems as if somewhere in the area of the PeopleEditor/EntityEditor classes a change was implemented that removes the <div> and the values of the <Entities> entry.
    I hope someone from Microsoft reads this despite the length of the post and either they tell me what I did wrong, an update to the June CU is released or a solution is included in the next CU...and I hope this helps other people to don't drive crazy while looking for a solution to the problem ;-)

    Friday, August 12, 2011 8:37 AM
  • Hi again,

    I played around with a test page and found out that the error doesn't occur, if I only have the PeopleEditor on the page. As soon as I add a ListView or GridView to the page and use the their edit, cancel or update methods (e.g. by adding a LinkButton with the commandName set to "update") the error occurs on the second postback...no matter what the second postback does in the background (I tested it with a buttom that simply has a for loop in its code-behind click method).

    Maybe that helps someone to find a solution...



    Monday, August 15, 2011 12:55 PM
  • I am experiencing this issue under the same circumstances as Chanda Cole. Can Jason Kuter work-around be used on the _layouts/AreaNavigationSettings.aspx page? Disabling the security for the site collection is really not an option.
    Tuesday, August 16, 2011 11:55 AM
  • Jason Kuter work-around worked perfectly for me. Thank You.
    Wednesday, August 17, 2011 6:20 PM
  • I am also experiencing the same problem. Jason Kuter's work-around is not working for me.  I found the dialog.master file under "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\TEMPLATE\LAYOUTS" and added the code to the bottom of the page (just before the </table> tag) and then did an iisreset.  Still get the same error.  Am I doing something wrong?

    Has anyone been given a work-around from Microsoft yet?

    Thursday, August 18, 2011 11:07 PM
  • I could apply the other work-around of turning the web page security settings to Off in Central Admin, but I'm not sure what the implications of that are.  Could anyone out there enlighten me?  Need to know if this is a worthwhile temporary work-around.
    Thursday, August 18, 2011 11:35 PM
  • Hi Brian, you need to add the code right at the end of dialog.master, so after the </html>

    I haven't heard of any permanent resolutions, i'm waiting to see if MS get back to Jason, otherwise I will have to find out how to log a Microsoft Support ticket I guess...

    Friday, August 19, 2011 5:48 AM
  • Hi


    Try Google Chrome...It works...

    We are facing the same issue and have opened a ticket with MS.


    Tuesday, August 23, 2011 10:11 PM
  • Hi Jothi,

    Any update on the MS ticket... interested in getting a resolution to the people picker problem too.



    Wednesday, August 31, 2011 10:35 AM
  • Hi,

    Try validating the people editor on each post back.

    if (IsPostBack)




    I had the same error and the above solved it.


    Good luck!


    Wednesday, August 31, 2011 2:56 PM
  • I opened a support ticket with Microsoft and they told me today to install the SharePoint 2007 August 2011 CU. After installing that CU I wasn't able to reproduce the people editor errors anymore. So it seems the August 2011 CU fixes the issues (although it doesn't say anything about it in the KB articles...again ;-) )

    Below you find links to the August 2011 CU


    Kind Regards,


    • Marked as answer by Mike Walsh FIN Thursday, September 1, 2011 12:51 PM
    Thursday, September 1, 2011 12:19 PM