The ImportCatalogPart control enables users to import a description file that describes settings on a WebPart control or server control that a user wants to add to a WebPartZoneBase zone.
After a user imports a description file, the WebPart control referenced in the file appears within the ImportCatalogPart control, and a user can add the control to the page.
The description file is not the same as the control itself. It is an XML file that ends with a .WebPart extension and contains name/value pairs--mostly property values--that describe the state of the control. The description file is created according to a specified XML format, as described in the topic Web Parts Control Description Files.
As for the control that the description file refers to, it can either be compiled into an assembly, or it can be a user control defined in an .ascx file. In either case, the control referenced in an imported description file must exist on the Web server that hosts the page that is attempting to import the control. The description file references the control name and the assembly (or file) that contains the control, and the description file contains settings that affect the control's property values, appearance, and behavior.
The ImportCatalogPart control enables users to share settings on controls. A complex control can have many properties and settings. For example, in a typical intranet site within a large company, a custom WebPart control might contain a number of properties that hold values specific to the users' environment, such as their database connections, departmental information, and so on. The control might also contain a number of properties that affect its appearance. One user could personalize the control on a particular site and get it working properly, export a description file for the control, and then share the description file with other users, who could import the file to add the fully configured control to other intranet sites that they are allowed to personalize. As long as the compiled assembly or user control file containing the control exists on the Web server that is hosting their site, users can add the control to other Web sites.
The mechanism by which users import a description file (and hence its associated server control) into a Web page is the ImportCatalogPart control, which a page developer must add to a Web page. When a user switches the page to catalog display mode, the ImportCatalogPart control appears, and the user can user this control to browse to the .WebPart description file corresponding to the server control they want to import. Following the UI and instructions provided by the ImportCatalogPart control, a user is able to add the desired server control into the Web page, with its appearance and properties fully configured as specified in the imported description file.
Before a WebPart control's description file can be imported, a user must first create (export) the file based on an existing WebPart control. A description file can be exported for a control if the following conditions are met:
The control has properties marked with the Personalizable attribute.
The Web.config file has the enableExport attribute value set to true on the <webParts> element.
A developer sets the value of the ExportMode property on the control to a value other than the default value of None, which prohibits export. If the ExportMode property value is set to NonSensitiveData, any property that contains an IsSensitive parameter with a Personalizable attribute is not exported when a user exports a description file. This enables control developers to prevent sensitive data, such as connection strings, from being exported in certain situations.
A user can export a control that has been enabled for export by clicking the export verb that appears in the verbs menu of the control, and following the instructions to save a .WebPart description file for the control. Other users can then import this file to configure their own instances of the control.
The ImportCatalogPart class contains several properties. The BrowseHelpText property contains text with instructions for users when they browse to locate the description file. The ImportedPartLabelText property contains text that serves as a label for the imported control as it appears within the ImportCatalogPart control. The PartImportErrorLabelText contains text that is displayed if an error occurs when a control description is being imported. The Title property overrides the base property to assign a default title for an ImportCatalogPart control if the developer does not assign a title. The UploadButtonText property contains the text for the button that the user clicks to upload the description file, and the UploadHelpText property contains the instructions for the upload process.
The ImportCatalogPart class also contains several unique methods. The GetAvailableWebPartDescriptions method retrieves a WebPartDescription object for each WebPart control in the catalog, which enables an ImportCatalogPart control to display information about each server control without having to create an instance of it. The GetWebPart method gets an instance of a particular WebPart control, based on the description passed to the method.
There are some inherent risks associated with using the ImportCatalogPart control. One example is the possibility of importing malicious data into your Web application through the description files used for importing. If someone has placed malicious script code as the value of a string property in the description file, then that script could potentially be executed when a user imports the description file and adds the referenced server control to a Web page. To minimize the risk of importing description files with malicious data, server controls that have string-typed properties should always encode the property data. Another risk involves importing types through description files (see Web Parts Control Description Files). A malicious user could submit requests to load many assemblies into the AppDomain, resulting in an excessive amount of memory being consumed.
To avoid the risks associated with import, you can disable the feature altogether by not using the import feature or the ImportCatalogPart control. Or you can limit what users have access to the control. You could do this programmatically, using role management (see Managing Authorization Using Roles). For instance, when the page loads, you could test to see whether a user is in a certain role, such as the administrator role. If the user is in the role, you could programmatically add the ImportCatalogPart control to the page for that user. You could also use a declarative approach to limit the set of users that can use the ImportCatalogPart control. Within your web page that contains a catalog, you could place two CatalogZone controls: one for users who can import, and one for those who cannot. The zone for users who can import would contain the ImportCatalogPart control. The zone itself could be placed inside of a LoginView control, which would enable you to limit use of the control in the zone to only those authenticated users or roles that you specify.