From 80be614731039e7c895c04bc9d6c55a3712a13d4 Mon Sep 17 00:00:00 2001 From: Claus Date: Mon, 14 Sep 2015 11:06:03 +0200 Subject: [PATCH 01/36] Fixes: U4-7075 Enable Content and Media section by default for new backoffice users --- src/Umbraco.Core/Services/UserService.cs | 3 +++ src/Umbraco.Tests/Services/UserServiceTests.cs | 14 ++++++++------ 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/src/Umbraco.Core/Services/UserService.cs b/src/Umbraco.Core/Services/UserService.cs index 74002646da..55d7dd9742 100644 --- a/src/Umbraco.Core/Services/UserService.cs +++ b/src/Umbraco.Core/Services/UserService.cs @@ -146,6 +146,9 @@ namespace Umbraco.Core.Services IsLockedOut = false, IsApproved = true }; + //adding default sections content and media + user.AddAllowedSection("content"); + user.AddAllowedSection("media"); if (SavingUser.IsRaisedEventCancelled(new SaveEventArgs(user), this)) return user; diff --git a/src/Umbraco.Tests/Services/UserServiceTests.cs b/src/Umbraco.Tests/Services/UserServiceTests.cs index f3100aa133..c7002ce79d 100644 --- a/src/Umbraco.Tests/Services/UserServiceTests.cs +++ b/src/Umbraco.Tests/Services/UserServiceTests.cs @@ -398,6 +398,10 @@ namespace Umbraco.Tests.Services var user1 = ServiceContext.UserService.CreateUserWithIdentity("test1", "test1@test.com", userType); + var result1 = ServiceContext.UserService.GetUserById((int)user1.Id); + //expect 2 sections by default + Assert.AreEqual(2, result1.AllowedSections.Count()); + //adds some allowed sections user1.AddAllowedSection("test1"); user1.AddAllowedSection("test2"); @@ -405,8 +409,9 @@ namespace Umbraco.Tests.Services user1.AddAllowedSection("test4"); ServiceContext.UserService.Save(user1); - var result1 = ServiceContext.UserService.GetUserById((int)user1.Id); - Assert.AreEqual(4, result1.AllowedSections.Count()); + result1 = ServiceContext.UserService.GetUserById((int)user1.Id); + //expect 6 sections including the two default sections + Assert.AreEqual(6, result1.AllowedSections.Count()); //simulate clearing the sections foreach (var s in user1.AllowedSections) @@ -419,11 +424,9 @@ namespace Umbraco.Tests.Services ServiceContext.UserService.Save(result1); //assert - //re-get result1 = ServiceContext.UserService.GetUserById((int)user1.Id); Assert.AreEqual(2, result1.AllowedSections.Count()); - } [Test] @@ -448,7 +451,6 @@ namespace Umbraco.Tests.Services var result2 = ServiceContext.UserService.GetUserById((int)user2.Id); Assert.IsFalse(result1.AllowedSections.Contains("test")); Assert.IsFalse(result2.AllowedSections.Contains("test")); - } [Test] @@ -546,7 +548,7 @@ namespace Umbraco.Tests.Services Assert.That(updatedItem.StartMediaId, Is.EqualTo(originalUser.StartMediaId)); Assert.That(updatedItem.Email, Is.EqualTo(originalUser.Email)); Assert.That(updatedItem.Username, Is.EqualTo(originalUser.Username)); - Assert.That(updatedItem.AllowedSections.Count(), Is.EqualTo(0)); + Assert.That(updatedItem.AllowedSections.Count(), Is.EqualTo(2)); } } } From 62611a7255cb6daad7f0caa80998377818097e91 Mon Sep 17 00:00:00 2001 From: Shannon Date: Tue, 29 Sep 2015 10:54:56 +0200 Subject: [PATCH 02/36] U4-7157 remove ~/umbraco/webservice.asmx --- src/Umbraco.Web.UI/Umbraco.Web.UI.csproj | 1 - src/Umbraco.Web.UI/umbraco/webService.asmx | 1 - src/Umbraco.Web/Umbraco.Web.csproj | 5 - .../umbraco/webService.asmx | 1 - .../umbraco/webService.asmx.cs | 217 ------------------ 5 files changed, 225 deletions(-) delete mode 100644 src/Umbraco.Web.UI/umbraco/webService.asmx delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx.cs diff --git a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj index bb30ea09b9..811295a34d 100644 --- a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj +++ b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj @@ -2258,7 +2258,6 @@ - Form diff --git a/src/Umbraco.Web.UI/umbraco/webService.asmx b/src/Umbraco.Web.UI/umbraco/webService.asmx deleted file mode 100644 index 19848579d6..0000000000 --- a/src/Umbraco.Web.UI/umbraco/webService.asmx +++ /dev/null @@ -1 +0,0 @@ -<%@ WebService Language="c#" Codebehind="webService.asmx.cs" Class="umbraco.webService" %> diff --git a/src/Umbraco.Web/Umbraco.Web.csproj b/src/Umbraco.Web/Umbraco.Web.csproj index 39b693af90..7a4c6a4cd0 100644 --- a/src/Umbraco.Web/Umbraco.Web.csproj +++ b/src/Umbraco.Web/Umbraco.Web.csproj @@ -1830,10 +1830,6 @@ - - webService.asmx - Component - CacheRefresher.asmx @@ -2119,7 +2115,6 @@ ASPXCodeBehind - Form diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx b/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx deleted file mode 100644 index 19848579d6..0000000000 --- a/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx +++ /dev/null @@ -1 +0,0 @@ -<%@ WebService Language="c#" Codebehind="webService.asmx.cs" Class="umbraco.webService" %> diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx.cs deleted file mode 100644 index a297825dda..0000000000 --- a/src/Umbraco.Web/umbraco.presentation/umbraco/webService.asmx.cs +++ /dev/null @@ -1,217 +0,0 @@ -using System; -using System.Collections; -using System.ComponentModel; -using System.Data; -using System.Diagnostics; -using System.Web; -using System.Web.Services; -using System.Xml; -using UmbracoExamine; -using System.Collections.Generic; -using Examine; -using umbraco.presentation; -using System.Linq; - -namespace umbraco -{ - - //TODO: There's no app checking security in here which means that any authorized user can query for all content and all media - // with all information exposed even when they don't have access to content or media. - - /// - /// Summary description for webService. - /// - /// - - [WebService(Namespace = "http://umbraco.org/webservices/")] - public class webService : System.Web.Services.WebService - { - public webService() - { - //CODEGEN: This call is required by the ASP.NET Web Services Designer - InitializeComponent(); - } - - [WebMethod] - public XmlNode GetNode(int NodeId, string ContextID) - { - XmlDocument xd = new XmlDocument(); - if (BasePages.BasePage.ValidateUserContextID(ContextID)) - { - return new cms.businesslogic.CMSNode(NodeId).ToXml(xd, false); - } - else - return null; - } - - [WebMethod] - public XmlNode GetNodeValidate(int NodeId, string Login, string Password) - { - XmlDocument xd = new XmlDocument(); - if (BusinessLogic.User.validateCredentials(Login, Password)) - { - return new cms.businesslogic.CMSNode(NodeId).ToXml(xd, false); - } - else - return null; - } - - [WebMethod] - public XmlNode GetDocument(int NodeId, string ContextID) - { - XmlDocument xd = new XmlDocument(); - if (BasePages.BasePage.ValidateUserContextID(ContextID)) - { - return new cms.businesslogic.web.Document(NodeId).ToXml(xd, false); - } - else - return null; - } - - [WebMethod] - public XmlNode GetMedia(int NodeId, string ContextID) - { - XmlDocument xd = new XmlDocument(); - if (BasePages.BasePage.ValidateUserContextID(ContextID)) - { - return new cms.businesslogic.media.Media(NodeId).ToXml(xd, false); - } - else - return null; - } - - [WebMethod] - public XmlNode GetMediaValidate(int NodeId, string Login, string Password) - { - XmlDocument xd = new XmlDocument(); - if (BusinessLogic.User.validateCredentials(Login, Password)) - { - return new cms.businesslogic.media.Media(NodeId).ToXml(xd, false); - } - else - return null; - } - - - [WebMethod] - public XmlNode GetDocumentValidate(int NodeId, string Login, string Password) - { - XmlDocument xd = new XmlDocument(); - if (BusinessLogic.User.validateCredentials(Login, Password)) - { - return new cms.businesslogic.web.Document(NodeId).ToXml(xd, false); - } - else - return null; - } - - [WebMethod] - public XmlNode GetDocumentsBySearchValidate(string Query, int StartNodeId, string Login, string Password) - { - XmlDocument xd = new XmlDocument(); - if (BusinessLogic.User.validateCredentials(Login, Password)) - { - return doQuery(Query, xd, StartNodeId); - } - else - { - XmlNode result = xd.CreateNode(XmlNodeType.Element, "error", ""); - result.AppendChild(xmlHelper.addTextNode(xd, "error", "Not a valid login")); - return result; - } - } - - [WebMethod] - public XmlNode GetDocumentsBySearch(string Query, int StartNodeId, string ContextID) - { - XmlDocument xd = new XmlDocument(); - if (BasePages.BasePage.ValidateUserContextID(ContextID)) - { - return doQuery(Query.ToLower(), xd, StartNodeId); - } - else - { - XmlNode result = xd.CreateNode(XmlNodeType.Element, "error", ""); - result.AppendChild(xmlHelper.addTextNode(xd, "error", "Not a valid login")); - return result; - } - } - - private XmlNode doQuery(string Query, XmlDocument xd, int StartNodeId) - { - XmlNode result = xd.CreateNode(XmlNodeType.Element, "documents", ""); - try - { - //if the query starts with "*" then query all fields - var internalSearcher = UmbracoContext.Current.InternalSearchProvider; - var criteria = internalSearcher.CreateSearchCriteria(IndexTypes.Content); - IEnumerable results; - if (Query.StartsWith("*")) - { - results = internalSearcher.Search("*", true); - } - else - { - var operation = criteria.NodeName(Query.ToLower()); - if (StartNodeId > 0) - { - operation.Or().Id(StartNodeId); - } - - results = internalSearcher.Search(operation.Compile()).Take(20); - } - - //var criteria = new SearchCriteria(Query - // , Query.StartsWith("*") ? new string[] { } : new string[] { "nodeName", "id" } - // , new string[] { } - // , false - // , StartNodeId > 0 ? (int?)StartNodeId : null - // , 20); - - foreach (var r in results) - { - XmlElement x = xd.CreateElement("document"); - x.SetAttribute("id", r.Id.ToString()); - x.SetAttribute("nodeName", r.Fields["nodeName"]); - result.AppendChild(x); - } - } - catch (Exception ee) - { - XmlElement x = xd.CreateElement("document"); - x.SetAttribute("id", "0"); - x.SetAttribute("nodeName", "Error in search: " + ee.ToString()); - result.AppendChild(x); - } - return result; - } - - #region Component Designer generated code - - //Required by the Web Services Designer - private IContainer components = null; - - /// - /// Required method for Designer support - do not modify - /// the contents of this method with the code editor. - /// - private void InitializeComponent() - { - } - - /// - /// Clean up any resources being used. - /// - protected override void Dispose(bool disposing) - { - if (disposing && components != null) - { - components.Dispose(); - } - base.Dispose(disposing); - } - - #endregion - - } -} From 05046638142c4289d5f9a4404d31e20b897b296c Mon Sep 17 00:00:00 2001 From: Shannon Date: Tue, 29 Sep 2015 11:28:12 +0200 Subject: [PATCH 03/36] Fixes: U4-7158 Fix OrderBy query string parameter which can allow SQL Injection --- .../Persistence/Repositories/VersionableRepositoryBase.cs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/Umbraco.Core/Persistence/Repositories/VersionableRepositoryBase.cs b/src/Umbraco.Core/Persistence/Repositories/VersionableRepositoryBase.cs index a7de116470..56b0b63ad5 100644 --- a/src/Umbraco.Core/Persistence/Repositories/VersionableRepositoryBase.cs +++ b/src/Umbraco.Core/Persistence/Repositories/VersionableRepositoryBase.cs @@ -3,6 +3,7 @@ using System.Collections.Generic; using System.Diagnostics; using System.Linq; using System.Text; +using System.Text.RegularExpressions; using System.Threading.Tasks; using Umbraco.Core.Configuration; using Umbraco.Core.Configuration.UmbracoSettings; @@ -521,7 +522,8 @@ WHERE EXISTS( //TODO: This isn't going to work very nicely because it's going to order by ID, not by letter return "umbracoNode.nodeUser"; default: - return orderBy; + //ensure invalid SQL cannot be submitted + return Regex.Replace(orderBy, @"[^\w\.,`\[\]@-]", ""); } } @@ -540,7 +542,8 @@ WHERE EXISTS( case "VERSIONDATE": return "UpdateDate"; default: - return orderBy; + //ensure invalid SQL cannot be submitted + return Regex.Replace(orderBy, @"[^\w\.,`\[\]@-]", ""); } } From c8dc10f2e32998acba9a9f050b210a69d88475e5 Mon Sep 17 00:00:00 2001 From: Shannon Date: Tue, 29 Sep 2015 11:44:22 +0200 Subject: [PATCH 04/36] Fixes: U4-7159 XSS issue with EditMacro.aspx --- src/Umbraco.Web.UI/umbraco/dialogs/editMacro.aspx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/Umbraco.Web.UI/umbraco/dialogs/editMacro.aspx b/src/Umbraco.Web.UI/umbraco/dialogs/editMacro.aspx index 93447605b3..c9225ac7c1 100644 --- a/src/Umbraco.Web.UI/umbraco/dialogs/editMacro.aspx +++ b/src/Umbraco.Web.UI/umbraco/dialogs/editMacro.aspx @@ -4,6 +4,7 @@ <%@ Import Namespace="Umbraco.Core.Configuration" %> <%@ Import Namespace="Umbraco.Web" %> +<%@ Import Namespace="Umbraco.Core" %> <%@ Register TagPrefix="cc2" Namespace="umbraco.uicontrols" Assembly="controls" %> @@ -15,7 +16,7 @@ $(document).ready(function () { Umbraco.Dialogs.EditMacro.getInstance().init({ useAspNetMasterPages: <%=UmbracoConfig.For.UmbracoSettings().Templates.UseAspNetMasterPages.ToString().ToLower() %>, - codeEditorElementId: "<%=Request.GetItemAsString("objectId")%>", + codeEditorElementId: "<%=Request.CleanForXss("objectId") %>", renderingEngine: "<%=Request.GetItemAsString("renderingEngine", "Mvc")%>", macroAlias: '<%= _macroAlias %>' }); From d50e49ad37fd5ca7bad2fd6e8fc994f3408ae70c Mon Sep 17 00:00:00 2001 From: Shannon Date: Tue, 29 Sep 2015 11:55:21 +0200 Subject: [PATCH 05/36] Fixes: U4-7120 SQL Fail upgrading om 7.2.4 to 7.3 - due to index on master col --- .../MigrateAndRemoveTemplateMasterColumn.cs | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenThreeZero/MigrateAndRemoveTemplateMasterColumn.cs b/src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenThreeZero/MigrateAndRemoveTemplateMasterColumn.cs index cb0ad58a49..01db36abd9 100644 --- a/src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenThreeZero/MigrateAndRemoveTemplateMasterColumn.cs +++ b/src/Umbraco.Core/Persistence/Migrations/Upgrades/TargetVersionSevenThreeZero/MigrateAndRemoveTemplateMasterColumn.cs @@ -3,6 +3,7 @@ using System.Linq; using Umbraco.Core.Configuration; using Umbraco.Core.Logging; using Umbraco.Core.Models.Rdbms; +using Umbraco.Core.Persistence.DatabaseModelDefinitions; using Umbraco.Core.Persistence.SqlSyntax; namespace Umbraco.Core.Persistence.Migrations.Upgrades.TargetVersionSevenThreeZero @@ -118,6 +119,22 @@ namespace Umbraco.Core.Persistence.Migrations.Upgrades.TargetVersionSevenThreeZe } + var dbIndexes = SqlSyntax.GetDefinedIndexes(Context.Database) + .Select(x => new DbIndexDefinition() + { + TableName = x.Item1, + IndexName = x.Item2, + ColumnName = x.Item3, + IsUnique = x.Item4 + }).ToArray(); + + //in some databases there's an index (IX_Master) on the master column which needs to be dropped first + var foundIndex = dbIndexes.FirstOrDefault(x => x.TableName.InvariantEquals("cmsTemplate") && x.ColumnName.InvariantEquals("master")); + if (foundIndex != null) + { + Delete.Index(foundIndex.IndexName).OnTable("cmsTemplate"); + } + if (cols.Any(x => x.ColumnName.InvariantEquals("master") && x.TableName.InvariantEquals("cmsTemplate"))) { Delete.Column("master").FromTable("cmsTemplate"); From 5fab1ea4362ed92f9260e2c727e8adc9f4660eff Mon Sep 17 00:00:00 2001 From: Sebastiaan Janssen Date: Thu, 1 Oct 2015 08:52:26 +0200 Subject: [PATCH 06/36] U4-7164 Nuget Update-Package UmbracoCms fails if I have removed dashboard section #U4-7164 Fixed Due in version 7.3.1 --- build/NuSpecs/tools/Dashboard.config.install.xdt | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/build/NuSpecs/tools/Dashboard.config.install.xdt b/build/NuSpecs/tools/Dashboard.config.install.xdt index e4d621f693..605bbb825e 100644 --- a/build/NuSpecs/tools/Dashboard.config.install.xdt +++ b/build/NuSpecs/tools/Dashboard.config.install.xdt @@ -1,6 +1,6 @@ -
+
@@ -20,7 +20,7 @@
-
+
views/dashboard/developer/developerdashboardvideos.html @@ -29,7 +29,7 @@
-
+
views/dashboard/developer/examinemanagement.html @@ -39,10 +39,10 @@ views/dashboard/developer/xmldataintegrityreport.html - +
-
+
@@ -52,7 +52,7 @@
-
+
@@ -72,7 +72,7 @@
-
+
From 14778422e60356fa89e7ba6da7738f0909662906 Mon Sep 17 00:00:00 2001 From: Patrik Date: Mon, 5 Oct 2015 14:22:57 +0200 Subject: [PATCH 07/36] Updated readme with working intro video , that is for umbraco v7 --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index d4a024ddbc..5988cc2a19 100644 --- a/README.md +++ b/README.md @@ -7,9 +7,9 @@ The easiest way to get started is to run `build/build.bat` which will build both If you're interested in making changes to Belle make sure to read the [Belle ReadMe file](src/Umbraco.Web.UI.Client/README.md). Note that you can always [download a nightly build](http://nightly.umbraco.org/umbraco%207.0.0/) so you don't have to build the code yourself. -## Watch a five minute introduction video ## +## Watch a introduction video ## -[![ScreenShot](http://umbraco.com/images/whatisumbraco.png)](http://umbraco.org/help-and-support/video-tutorials/getting-started/what-is-umbraco) +[![ScreenShot](http://umbraco.com/images/whatisumbraco.png)](https://umbraco.tv/videos/umbraco-v7/content-editor/basics/introduction/cms-explanation/) ## Umbraco - the simple, flexible and friendly ASP.NET CMS ## From 96d46c82fe37654aab73993b8f14fff9815c4860 Mon Sep 17 00:00:00 2001 From: Sebastiaan Janssen Date: Tue, 6 Oct 2015 08:57:58 +0200 Subject: [PATCH 08/36] U4-7193 NuGet install doesn't add all bindingRedirects #U4-7193 Fixed Due in version 7.3.1 --- build/NuSpecs/tools/Web.config.install.xdt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/build/NuSpecs/tools/Web.config.install.xdt b/build/NuSpecs/tools/Web.config.install.xdt index f7fbad09bd..c6a55cc981 100644 --- a/build/NuSpecs/tools/Web.config.install.xdt +++ b/build/NuSpecs/tools/Web.config.install.xdt @@ -172,23 +172,23 @@ - + - + - + - + - + From 5e5207d4f34485b37dc014fe977898ef984e0879 Mon Sep 17 00:00:00 2001 From: Shannon Date: Tue, 6 Oct 2015 10:56:16 +0200 Subject: [PATCH 09/36] Fixes: U4-7194 XSS issue with regexws page, U4-7195 XSS issue with editview.aspx --- src/Umbraco.Web.UI/umbraco/dialogs/RegexWs.aspx | 3 ++- src/Umbraco.Web.UI/umbraco/settings/views/EditView.aspx | 3 ++- src/Umbraco.Web.UI/umbraco/settings/views/EditView.aspx.cs | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/Umbraco.Web.UI/umbraco/dialogs/RegexWs.aspx b/src/Umbraco.Web.UI/umbraco/dialogs/RegexWs.aspx index 6dd0954156..c2cbe45978 100644 --- a/src/Umbraco.Web.UI/umbraco/dialogs/RegexWs.aspx +++ b/src/Umbraco.Web.UI/umbraco/dialogs/RegexWs.aspx @@ -1,4 +1,5 @@ <%@ Page Language="C#" AutoEventWireup="true" MasterPageFile="../masterpages/umbracoDialog.Master" CodeBehind="RegexWs.aspx.cs" Inherits="umbraco.presentation.dialogs.RegexWs" %> +<%@ Import Namespace="Umbraco.Web" %> <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %> <%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %> @@ -40,7 +41,7 @@