Starting a few months ago we started receiving System.Web.HttpException: Invalid viewstate. errors thru our websites. It started out just happening very rarely and we started getting more and more of the errors. The callstack was usually:

System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Web.HttpException: Invalid viewstate.at System.Web.UI.Page.DecryptString(String s)--- End of inner exception stack trace ---at System.RuntimeMethodHandle._InvokeMethodFast(Object target, Object[] arguments, SignatureStruct& sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner)at System.RuntimeMethodHandle.InvokeMethodFast(Object target, Object[] arguments, Signature sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner)at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture, Boolean skipVisibilityChecks)at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)at System.Reflection.MethodBase.Invoke(Object obj, Object[] parameters)at System.Web.Handlers.ScriptResourceHandler.DecryptString(String s)at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString)at System.Web.Handlers.ScriptResourceHandler.ProcessRequest(HttpContext context)at System.Web.Handlers.ScriptResourceHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext context)at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)   

I looked at similarities of the error and noticed that the user agent was always:

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)

Also, the query string would contain HTML text in the querystring, like:

d=Q0M5xAMIxE-XI2-0ILfpxYhpmFOEVhqxB_ONfw1nSIFAoH8HCyt--97Kq_DD1JoDIf7tnu8rxs0nJzeGOz1YULX%20%20%20%20%20%20%20%20%20%20%20<table%20style=

So it seemed that IE 8 was causing the error, after research I found that I was right. IE8 was causing the problem. I found this bug report on the issue.

https://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=434997 

We've launched a new site, OmahaBarCard.com.

With it you can get deals from over 72 bars in Omaha, Nebraska.

We're going to be adding more later such as image galleries and event calendars.

At&t began offering their high speed cellular 3G data network today in Lincoln.  Much faster than the existing Edge data network, 3G allows wireless users to surf the web and download music and files at speeds up to 14.4 Mbits on the downlink and 5.8 Mbits on the uplink.  This new service opens up a wide range of new capabilities for iPhone users who own the latest 3G enabled version of the popular handset.  At&t had promised Lincoln and Omaha iPhone users that it would have 3G service in place by the end of 2008, effectively delivering the service in Lincoln a full month ahead of schedule.

On October 18th Microsoft officially released Silverlight 2.0.  From silverlight.net: "Microsoft Silverlight extends and amplifies your existing development skills, empowering you to build new types of applications for the Web regardless of target platform or browser."

Microsoft is hoping that Silverlight will come to market as a viable competitor to Adobe System's FLEX platform for delivering the next generation of Rich Internet Applications (RIA).  Using the power and extensibility of Windows Presentation Foundation (WPF), Sliverlight is set to bring the flexibility and design absolutes that Windows Forms designers enjoy.  Silverlight uses the same XAML interface design language (think Application XML) that WPF applications are built on, making the transition from desktop to web a painless one.  

Stay tuned for a Tech Studio review on the new Silverlight SDK and Toolkit that was updated with this release.

UPDATE: There's a permanent fix at the end of the post  

After our client computers ran the update Cumulative Security Update for ActiveX Killbits (KB956391) it broke the reporting servies report viewer.

Security Advisory for 956391

If you have the update and you click the print button on the report viewer control you will recieve a message that says "Unable to load client print control"

I've looked around to see if there's anything to update, such as the servers version of Reporting services or the ReportViewer control.
On a test server I've installed the newest ReportViewer control but it didn't seem to fix the issue.

I've found that removing the hotfix fixes the issue.

From the way it sounds the killbit was set for the control because it had a vulnerability where GDI+ could allow remote code execution.

Microsoft Security Bulletin MS08-052

Edit:There's a ReportViewer SP1 but that doesn't seem to solve the issue for me, where others have stated it's solved their issue.

I've found a temporary solution, its not a very good solution cause you'll still open up the vulnerability but until microsoft comes out with a new reportviewer control there's not much of a choice.

You can turn off the killbits for the control thru the registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA91DF8D-53AB-455D-AB20-F2F023E498D3}]

"Compatibility Flags"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FA91DF8D-53AB-455D-AB20-F2F023E498D3}]

"Compatibility Flags"=-

 Then when you want to  turn them back on

 Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FA91DF8D-53AB-455D-AB20-F2F023E498D3}]

"Compatibility Flags"=dword:00000400

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FA91DF8D-53AB-455D-AB20-F2F023E498D3}]

"Compatibility Flags"=dword:00000400

 I will keep this updated if I find a better solution. 

UPDATE FOR PERMANENT FIX :

There's SQL server updates that fix the issue.

Install the appropriate update for your SQL server version.

for SQL version 9.00.3042-9.00.3072 get the GDR version

for SQL version 9.00.3150-9.00.3281 get the QFE Version

UPDATE 10/20:

Over the weekend I applied the patches to our SQL server and we're still getting the issue in our application. However, I'm able to print fine from the Reporting Services Reporting Manager, which didn't work before the patch.

Just briefly what we're running for servers, We've got a SQL Server 2005 SP2 with the GDR update running on Windows 2003, and a Web Server on Windows 2003.

I'm guessing that I need to update the control in our application, but I'm not sure where I would get the newer version. It doesn't seem to be part of the ReportViewer 2005 SP1 Redist.

I'll keep this blog updated if I find out anything. 

UPDATE 8-4-09

Sorry for not updating this till now.. I've figured out a solution, but its not a very good one.
After updating the SQL server to Service Pack 2 from the above links, I had to manually update gdiplus.dll on all our client computers.

I also manually updated the report viewer 2008 control.

I used the GDIplus.dll that was installed on the webserver when SQL Server SP2 was installed.

Post a comment if you have any questions.

For enthusiasts of the .NET framework (like me) and supporters of the Linux operating system (also like me) today is a great day for cross-platform development.  Mono, the .NET implementation for the Linux platform was just released.  This release brings a far greater scope of compatibility and libraries to the developer toolbox and allows for compilation of Visual Basic 8 and C Sharp 3.0 code that will run natively on the Linux platform.

From mono-project.com:

"Mono 2.0 is a portable and open source implementation of the .NET framework for Unix, Windows, MacOS and other operating systems.

Microsoft Compatible APIs

• ADO.NET 2.0 API for accessing databases.

• ASP.NET 2.0 API for developing Web-based applications.

• Windows.Forms 2.0 API to create desktop applications.

• System.XML 2.0: An API to manipulate XML documents.

• System.Core: Provides support for the Language Integrated Query (LINQ).

• System.Xml.Linq: Provides a LINQ provider for XML.

• System.Drawing 2.0 API: A portable graphics rendering API.

Mono APIs

• Gtk# 2.12: A binding to the Gtk+ 2.12 and GNOME libraries for creating desktop applications on Linux, Windows and MacOS X.
• Mono.Cecil: A library to manipulate ECMA CLI files (the native format used for executables and libraries).
• Mono.Cairo: A binding to the Cairo Graphics library to produce 2D graphics and render them into a variety of forms (images, windows, postscript and PDF).
• Mono's SQLite support: a library to create and consume databases created with SQLite.
• Mono.Posix: a library to access Linux and Unix specific functionality from your managed application. With both a low-level interface as well as higher level interfaces."

Following on the heels of major technology institutions like MIT and Harvard, Stanford University is now offering several Computer Science classes, along with the corresponding materials, for FREE via their website.

 From the site:

 "For the first time in its history, Stanford is offering some of its most popular engineering classes free of charge to students and educators around the world. Stanford Engineering Everywhere (SEE) expands the Stanford experience to students and educators online. A computer and an Internet connection are all you need. View lecture videos, access reading lists and other course handouts, take quizzes and tests, and communicate with other SEE students, all at your convenience."

This is great news for those of us who wish to get the best possible online education from some of the most talented faculty in the industry.

If you see this post it means that BlogEngine.NET 1.4.5 is running and the hard part of creating your own blog is done. There is only a few things left to do.

Write Permissions

To be able to log in to the blog and writing posts, you need to enable write permissions on the App_Data folder. If you’re blog is hosted at a hosting provider, you can either log into your account’s admin page or call the support. You need write permissions on the App_Data folder because all posts, comments, and blog attachments are saved as XML files and placed in the App_Data folder. 

If you wish to use a database to to store your blog data, we still encourage you to enable this write access for an images you may wish to store for your blog posts.  If you are interested in using Microsoft SQL Server, MySQL, VistaDB, or other databases, please see the BlogEngine wiki to get started.

Security

When you've got write permissions to the App_Data folder, you need to change the username and password. Find the sign-in link located either at the bottom or top of the page depending on your current theme and click it. Now enter "admin" in both the username and password fields and click the button. You will now see an admin menu appear. It has a link to the "Users" admin page. From there you can change the username and password.  Passwords are hashed by default so if you lose your password, please see the BlogEngine wiki for information on recovery.

Configuration and Profile

Now that you have your blog secured, take a look through the settings and give your new blog a title.  BlogEngine.NET 1.4 is set up to take full advantage of of many semantic formats and technologies such as FOAF, SIOC and APML. It means that the content stored in your BlogEngine.NET installation will be fully portable and auto-discoverable.  Be sure to fill in your author profile to take better advantage of this.

Themes and Widgets

One last thing to consider is customizing the look of your blog.  We have a few themes available right out of the box including two fully setup to use our new widget framework.  The widget framework allows drop and drag placement on your side bar as well as editing and configuration right in the widget while you are logged in.  Be sure to check out our home page for more theme choices and downloadable widgets to add to your blog.

On the web

You can find BlogEngine.NET on the official website. Here you'll find tutorials, documentation, tips and tricks and much more. The ongoing development of BlogEngine.NET can be followed at CodePlex where the daily builds will be published for anyone to download.

Good luck and happy writing.

The BlogEngine.NET team