ControllerFactory | ControllerFactory is a framework | Frontend Framework library

The controller factory is simply a Callback, Object> whose call(Class type) function takes the class defined in the fx:controller attribute in the FXML file and returns the object to be used as the controller. This is invoked by the FXMLLoader at the time the FXML is loaded.

I think your question is asking if you can use a controller factory to automatically populate controllers with data that's stored in JSON, which will be read at runtime.

You can do something like this:

The controller for your view action is likely using contain to include the Dishes and Recipes for the Product, while the index action is not. You should be able to simply update the contain part of the query in index, or add it if it's missing entirely.

I have just found the answer to my own question. The HttpRuntime executionTimeout setting (default to 110 seconds for ASP.NET 2+) controls the maximum request thread duration AND the session state lock duration. So, after 110 second of processing, it possible for another request from the same session to be processed since the session lock has been released. In my case, as stated by @user2116910 in the SO link below, the first request processing thread is never killed (maybe due to the fact that the application has been deployed using debug config ! :-/)

References:

• https://kb.sitecore.net/articles/858026
• https://docs.microsoft.com/en-us/aspnet/aspnet/overview/web-development-best-practices/what-not-to-do-in-aspnet-and-what-to-do-instead#long
• https://stackoverflow.com/a/20084159/4627054

As can be seen in the stacktrace, the error stems from the form protection component, not the security component, so unlocking actions on the security component won't do anything.

The security component is deprecated (the Cookbook doesn't seem to mention that), and the form protection component is one of the utilities that are ment to replace it (others are the CSRF middleware and the HTTPS enforcer middleware) - you shouldn't use both, drop the security component (and by that I mean to also remove the related loadComponent() call), and configure the form protection component accordingly instead!

The sort field whitelist must be passed in the config when using the paginator directly.

The security component is deprecated, its features have been extracted into the form protection component, and the HTTPS enforcer middleware. The fact that it's deprecated should probably be presented more prominently in the Cookbook.

Using both, the form protection component and the security component will lead to the error that you're encountering, as both, the security component as well as the form protection component, will remove the _Token from the request data once it has been validated, hence one of them will complain about the token not being present.

Long story short, don't use the security component, use only the form protection component. If you were using the security component's require SSL feature, then use the initially mentioned HTTPS enforcer middleware instead.

See also

• Cookbook > 4.0 Migration Guide > Deprecations > Component
• Cookbook > Middleware > HTTPS Enforcer Middleware

First of all, your code example blindly trusts the client, it accepts any file, and allows to choose arbitrary target locations by passing a path as the filename! Never use client data without validating/sanitizing it, trusting the file date provided by the client can lead to all sorts of vulnerabilities!!!

That being said, usually you either use a separate field for the file upload, or a custom database type that doesn't transform the data when it is being marshalled, so that you can transform it manually afterwards. Currently you seem to use the field for the upload that is supposed to hold a string in the database, hence the marshaller will try to convert the input to a string, and that will of course fail.

So for example, rename the form control from image to image_file (no such column should exist in the database), add proper validation rules for image_file, something along the lines of this, to ensure that the upload is valid, ie check the type, the size, the name, etc: