From 26a7bf81872de6c9f4b70d2ff8fc29c91ea38594 Mon Sep 17 00:00:00 2001
From: Shannon Deminick <sdeminick@gmail.com>
Date: Fri, 12 Apr 2013 02:11:01 +0600
Subject: [PATCH] Fixes: #U4-2087

---
 .../Configuration/UmbracoSettings.cs          |  12 +
 .../config/umbracoSettings.Release.config     |   3 +
 .../config/umbracoSettings.config             | 333 +++++++++---------
 src/Umbraco.Web.UI/umbraco/config/lang/en.xml |   1 +
 .../umbraco/config/lang/en_us.xml             |   1 +
 src/umbraco.businesslogic/ApplicationTree.cs  | 103 ++----
 src/umbraco.businesslogic/UmbracoSettings.cs  |   7 +
 .../uploadfield/uploadField.cs                | 212 +++++++----
 8 files changed, 352 insertions(+), 320 deletions(-)

diff --git a/src/Umbraco.Core/Configuration/UmbracoSettings.cs b/src/Umbraco.Core/Configuration/UmbracoSettings.cs
index 38ab03e97d..fd7cc9ade9 100644
--- a/src/Umbraco.Core/Configuration/UmbracoSettings.cs
+++ b/src/Umbraco.Core/Configuration/UmbracoSettings.cs
@@ -670,6 +670,18 @@ namespace Umbraco.Core.Configuration
             }
         }
 
+        /// <summary>
+        /// File types that will not be allowed to be uploaded via the content/media upload control
+        /// </summary>
+	    public static IEnumerable<string> DissallowedUploadFiles
+	    {
+	        get
+	        {
+                var val = GetKey("/settings/content/dissallowedUploadFiles");
+	            return val.Split(new[] {','}, StringSplitOptions.RemoveEmptyEntries);
+	        }
+	    }
+
 		/// <summary>
 		/// Gets the allowed image file types.
 		/// </summary>
diff --git a/src/Umbraco.Web.UI/config/umbracoSettings.Release.config b/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
index 96b2d65cf6..7d3d0848ad 100644
--- a/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
+++ b/src/Umbraco.Web.UI/config/umbracoSettings.Release.config
@@ -108,6 +108,9 @@
                                       then the file in the sprite overrules the one on disk, the file
                                       on disk will be shown (recommended) -->
     <DocumentTypeIconList>ShowDuplicates</DocumentTypeIconList>
+
+    <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
+    <dissallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd</dissallowedUploadFiles>
   </content>
 
   <security>
diff --git a/src/Umbraco.Web.UI/config/umbracoSettings.config b/src/Umbraco.Web.UI/config/umbracoSettings.config
index fd614c87d4..d6d0fa081f 100644
--- a/src/Umbraco.Web.UI/config/umbracoSettings.config
+++ b/src/Umbraco.Web.UI/config/umbracoSettings.config
@@ -1,95 +1,95 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <settings>
-    <content>
-        <imaging>
-            <!-- what file extension that should cause umbraco to create thumbnails -->
-            <imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif</imageFileTypes>
-            <!-- what attributes that are allowed in the editor on an img tag -->
-            <allowedAttributes>src,alt,border,class,style,align,id,name,onclick,usemap</allowedAttributes>
-            <!-- automatically updates dimension, filesize and extension attributes on upload -->
-            <autoFillImageProperties>
-                <uploadField alias="umbracoFile">
-                    <widthFieldAlias>umbracoWidth</widthFieldAlias>
-                    <heightFieldAlias>umbracoHeight</heightFieldAlias>
-                    <lengthFieldAlias>umbracoBytes</lengthFieldAlias>
-                    <extensionFieldAlias>umbracoExtension</extensionFieldAlias>
-                </uploadField>
-            </autoFillImageProperties>
-        </imaging>
-        <scripteditor>
-            <!-- Path to script folder - no ending "/" -->
-            <scriptFolderPath>/scripts</scriptFolderPath>
-            <!-- what files can be opened/created in the script editor -->
-            <scriptFileTypes>js,xml</scriptFileTypes>
-            <!-- disable the codemirror editor and use a simple textarea instead -->
-            <scriptDisableEditor>false</scriptDisableEditor>
-        </scripteditor>
+  <content>
+    <imaging>
+      <!-- what file extension that should cause umbraco to create thumbnails -->
+      <imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif</imageFileTypes>
+      <!-- what attributes that are allowed in the editor on an img tag -->
+      <allowedAttributes>src,alt,border,class,style,align,id,name,onclick,usemap</allowedAttributes>
+      <!-- automatically updates dimension, filesize and extension attributes on upload -->
+      <autoFillImageProperties>
+        <uploadField alias="umbracoFile">
+          <widthFieldAlias>umbracoWidth</widthFieldAlias>
+          <heightFieldAlias>umbracoHeight</heightFieldAlias>
+          <lengthFieldAlias>umbracoBytes</lengthFieldAlias>
+          <extensionFieldAlias>umbracoExtension</extensionFieldAlias>
+        </uploadField>
+      </autoFillImageProperties>
+    </imaging>
+    <scripteditor>
+      <!-- Path to script folder - no ending "/" -->
+      <scriptFolderPath>/scripts</scriptFolderPath>
+      <!-- what files can be opened/created in the script editor -->
+      <scriptFileTypes>js,xml</scriptFileTypes>
+      <!-- disable the codemirror editor and use a simple textarea instead -->
+      <scriptDisableEditor>false</scriptDisableEditor>
+    </scripteditor>
 
-        <!-- should umbraco store the uploaded files like /media/xxx/filename.ext or like /media/xxx-filename.ext
+    <!-- should umbraco store the uploaded files like /media/xxx/filename.ext or like /media/xxx-filename.ext
 		should be set to false if the application pool's user account hasn't got readrights of the driveroot up to the /media directory -->
-        <UploadAllowDirectories>True</UploadAllowDirectories>
-        <errors>
-            <!-- the id of the page that should be shown if the page is not found -->
-            <!--<error404>
+    <UploadAllowDirectories>True</UploadAllowDirectories>
+    <errors>
+      <!-- the id of the page that should be shown if the page is not found -->
+      <!--<error404>
                    <errorPage culture="default">1</errorPage>
                    <errorPage culture="en-US">200</errorPage>
             </error404>-->
-            <error404>
-                <errorPage culture="default">1047</errorPage>
-                <errorPage culture="en-US">1047</errorPage>
-                <errorPage culture="en-UK">1047</errorPage>
-            </error404>
-        </errors>
-        <notifications>
-            <!-- the email that should be used as from mail when umbraco sends a notification -->
-            <email>robot@umbraco.dk</email>
-        </notifications>
+      <error404>
+        <errorPage culture="default">1047</errorPage>
+        <errorPage culture="en-US">1047</errorPage>
+        <errorPage culture="en-UK">1047</errorPage>
+      </error404>
+    </errors>
+    <notifications>
+      <!-- the email that should be used as from mail when umbraco sends a notification -->
+      <email>robot@umbraco.dk</email>
+    </notifications>
 
-        <!-- if true umbraco will ensure that no page under the same parent has an identical name -->
-        <ensureUniqueNaming>True</ensureUniqueNaming>
+    <!-- if true umbraco will ensure that no page under the same parent has an identical name -->
+    <ensureUniqueNaming>True</ensureUniqueNaming>
 
-        <!-- clean editor content with use of tidy -->
-        <TidyEditorContent>False</TidyEditorContent>
+    <!-- clean editor content with use of tidy -->
+    <TidyEditorContent>False</TidyEditorContent>
 
-        <!-- the encoding type for tidy. Default is Raw, options are ASCII, Raw, Latin1, UTF8, ISO2022, MacroMan-->
-        <TidyCharEncoding>Raw</TidyCharEncoding>
+    <!-- the encoding type for tidy. Default is Raw, options are ASCII, Raw, Latin1, UTF8, ISO2022, MacroMan-->
+    <TidyCharEncoding>Raw</TidyCharEncoding>
 
-        <!-- Enable / disable xml content cache -->
-        <XmlCacheEnabled>True</XmlCacheEnabled>
+    <!-- Enable / disable xml content cache -->
+    <XmlCacheEnabled>True</XmlCacheEnabled>
 
-        <!-- Update disk cache every time content has changed -->
-        <ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>
+    <!-- Update disk cache every time content has changed -->
+    <ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>
 
-        <!-- Update in-memory cache if xml file is changed -->
-        <XmlContentCheckForDiskChanges>True</XmlContentCheckForDiskChanges>
+    <!-- Update in-memory cache if xml file is changed -->
+    <XmlContentCheckForDiskChanges>True</XmlContentCheckForDiskChanges>
 
-        <!-- Show the /config/splashes/booting.aspx page while initializing content -->
-        <EnableSplashWhileLoading>False</EnableSplashWhileLoading>
+    <!-- Show the /config/splashes/booting.aspx page while initializing content -->
+    <EnableSplashWhileLoading>False</EnableSplashWhileLoading>
 
-        <!-- Show property descriptions in editing view "icon|text|none" -->
-        <PropertyContextHelpOption>text</PropertyContextHelpOption>
+    <!-- Show property descriptions in editing view "icon|text|none" -->
+    <PropertyContextHelpOption>text</PropertyContextHelpOption>
 
-        <UseLegacyXmlSchema>false</UseLegacyXmlSchema>
+    <UseLegacyXmlSchema>false</UseLegacyXmlSchema>
 
-        <cloneXmlContent>true</cloneXmlContent>
+    <cloneXmlContent>true</cloneXmlContent>
 
-        <ForceSafeAliases>true</ForceSafeAliases>
+    <ForceSafeAliases>true</ForceSafeAliases>
 
-        <PreviewBadge><![CDATA[<a id="umbracoPreviewBadge" style="position: absolute; top: 0; right: 0; border: 0; width: 149px; height: 149px; background: url('{1}/preview/previewModeBadge.png') no-repeat;" href="{0}/endPreview.aspx?redir={2}"><span style="display:none;">In Preview Mode - click to end</span></a>]]></PreviewBadge>
+    <PreviewBadge><![CDATA[<a id="umbracoPreviewBadge" style="position: absolute; top: 0; right: 0; border: 0; width: 149px; height: 149px; background: url('{1}/preview/previewModeBadge.png') no-repeat;" href="{0}/endPreview.aspx?redir={2}"><span style="display:none;">In Preview Mode - click to end</span></a>]]></PreviewBadge>
 
-        <!-- Cache cycle of Media and Member data fetched from the umbraco.library methods -->
-        <!-- In seconds. 0 will disable cache -->
-        <UmbracoLibraryCacheDuration>1800</UmbracoLibraryCacheDuration>
+    <!-- Cache cycle of Media and Member data fetched from the umbraco.library methods -->
+    <!-- In seconds. 0 will disable cache -->
+    <UmbracoLibraryCacheDuration>1800</UmbracoLibraryCacheDuration>
 
-        <!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
+    <!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
              - inline - show an inline error within the macro but allow the page to continue rendering. Historial Umbraco behaviour.
              - silent - Silently suppress the error and do not render the offending macro.
              - throw  - Throw an exception which can be caught by the global error handler defined in Application_OnError. If no such
                         error handler is defined then you'll see the Yellow Screen Of Death (YSOD) error page.
              Note the error can also be handled by the umbraco.macro.Error event, where you can log/alarm with your own code and change the behaviour per event. -->
-        <MacroErrors>inline</MacroErrors> 
-      
-        <!-- How Umbraco should show icons in the document type editor. Historically, the list has included all the files in
+    <MacroErrors>inline</MacroErrors>
+
+    <!-- How Umbraco should show icons in the document type editor. Historically, the list has included all the files in
              /Umbraco/Images/Umbraco plus a CSS sprite defined in Umbraco_Client/Tree/treeIcons.css, unfortunately these 
              contain many duplicates. The DocumentTypeIconList setting allows you to favor one list over the other.
              
@@ -101,117 +101,120 @@
              - HideFileDuplicates   - If a file exists on disk with the same name as one in the sprite
                                       then the file in the sprite overrules the one on disk, the file
                                       on disk will be shown (recommended) -->
-      <DocumentTypeIconList>HideFileDuplicates</DocumentTypeIconList> 
-    </content>
-
-    <security>
-        <!-- set to true to auto update login interval (and there by disabling the lock screen -->
-        <keepUserLoggedIn>true</keepUserLoggedIn>
-
-        <!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
-        <hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
-    </security>
-
-    <requestHandler>
-        <!-- this will ensure that urls are unique when running with multiple root nodes -->
-        <useDomainPrefixes>false</useDomainPrefixes>
-        <!-- this will add a trailing slash (/) to urls when in directory url mode -->
-        <addTrailingSlash>false</addTrailingSlash>
-        <urlReplacing removeDoubleDashes="true">
-            <char org=" ">-</char>
-            <char org="&quot;"></char>
-            <char org="."></char>
-            <char org=";"></char>
-            <char org="/"></char>
-            <char org=":"></char>
-            <char org="+">plus</char>
-            <char org="*">star</char>
-            <char org="&amp;"></char>
-            <char org="?"></char>
-            <char org="æ">ae</char>
-            <char org="ø">oe</char>
-            <char org="å">aa</char>
-        </urlReplacing>
-    </requestHandler>
+    <DocumentTypeIconList>HideFileDuplicates</DocumentTypeIconList>
     
-    <templates>
-        <useAspNetMasterPages>true</useAspNetMasterPages>
-        <enableSkinSupport>true</enableSkinSupport>
-				<defaultRenderingEngine>Mvc</defaultRenderingEngine>
-    </templates>
+    <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
+    <dissallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd</dissallowedUploadFiles>
+  </content>
 
-    <!-- this is used by Umbraco to determine if there's valid classes in the /App_Code folder to be used for Rest/XSLT extensions -->
-    <developer>
-        <appCodeFileExtensions>
-            <ext>cs</ext>
-            <ext>vb</ext>
-        </appCodeFileExtensions>
-    </developer>
-    
-    <viewstateMoverModule enable="false" />
+  <security>
+    <!-- set to true to auto update login interval (and there by disabling the lock screen -->
+    <keepUserLoggedIn>true</keepUserLoggedIn>
 
-		<!-- 
+    <!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
+    <hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
+  </security>
+
+  <requestHandler>
+    <!-- this will ensure that urls are unique when running with multiple root nodes -->
+    <useDomainPrefixes>false</useDomainPrefixes>
+    <!-- this will add a trailing slash (/) to urls when in directory url mode -->
+    <addTrailingSlash>false</addTrailingSlash>
+    <urlReplacing removeDoubleDashes="true">
+      <char org=" ">-</char>
+      <char org="&quot;"></char>
+      <char org="."></char>
+      <char org=";"></char>
+      <char org="/"></char>
+      <char org=":"></char>
+      <char org="+">plus</char>
+      <char org="*">star</char>
+      <char org="&amp;"></char>
+      <char org="?"></char>
+      <char org="æ">ae</char>
+      <char org="ø">oe</char>
+      <char org="å">aa</char>
+    </urlReplacing>
+  </requestHandler>
+
+  <templates>
+    <useAspNetMasterPages>true</useAspNetMasterPages>
+    <enableSkinSupport>true</enableSkinSupport>
+    <defaultRenderingEngine>Mvc</defaultRenderingEngine>
+  </templates>
+
+  <!-- this is used by Umbraco to determine if there's valid classes in the /App_Code folder to be used for Rest/XSLT extensions -->
+  <developer>
+    <appCodeFileExtensions>
+      <ext>cs</ext>
+      <ext>vb</ext>
+    </appCodeFileExtensions>
+  </developer>
+
+  <viewstateMoverModule enable="false" />
+
+  <!-- 
 		Now that we have Log4Net logging enabled, this section is only used for what gets logged to the umbracoLog table
 		which currently logs items used in the audit trail and roll back scenarios.
 		-->
-    <logging>
-        <enableLogging>true</enableLogging>
-        <enableAsyncLogging>true</enableAsyncLogging>
-        <disabledLogTypes>
-            <!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
-        </disabledLogTypes>
-        <autoCleanLogs>falses</autoCleanLogs>
-        <cleaningMiliseconds>86400</cleaningMiliseconds>
-        <maxLogAge>1440</maxLogAge>
-    </logging>
+  <logging>
+    <enableLogging>true</enableLogging>
+    <enableAsyncLogging>true</enableAsyncLogging>
+    <disabledLogTypes>
+      <!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
+    </disabledLogTypes>
+    <autoCleanLogs>falses</autoCleanLogs>
+    <cleaningMiliseconds>86400</cleaningMiliseconds>
+    <maxLogAge>1440</maxLogAge>
+  </logging>
 
-    <scheduledTasks>
-        <!-- add tasks that should be called with an interval (seconds) -->
-        <!--    <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
-    </scheduledTasks>
+  <scheduledTasks>
+    <!-- add tasks that should be called with an interval (seconds) -->
+    <!--    <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
+  </scheduledTasks>
 
-    <!-- distributed calls make umbraco use webservices to handle cache refreshing -->
-    <distributedCall enable="false">
-        <!-- the id of the user who's making the calls -->
-        <!-- needed for security, umbraco will automatically look up correct login and passwords -->
-        <user>0</user>
-        <servers>
-            <!-- add ip number or hostname, make sure that it can be reached from all servers -->
-            <!-- <server>127.0.0.1</server>-->
-        </servers>
-    </distributedCall>
+  <!-- distributed calls make umbraco use webservices to handle cache refreshing -->
+  <distributedCall enable="false">
+    <!-- the id of the user who's making the calls -->
+    <!-- needed for security, umbraco will automatically look up correct login and passwords -->
+    <user>0</user>
+    <servers>
+      <!-- add ip number or hostname, make sure that it can be reached from all servers -->
+      <!-- <server>127.0.0.1</server>-->
+    </servers>
+  </distributedCall>
 
-    <!-- configuration for webservices -->
-    <!-- webservices are disabled by default. Set enable="True" to enable them -->
-    <webservices enabled="True">
-        <!-- You must set user-rights for each service. Enter the usernames seperated with comma (,) -->
-        <documentServiceUsers>umbraco</documentServiceUsers>
-        <fileServiceUsers>umbraco</fileServiceUsers>
-        <fileServiceFolders>css,xslt</fileServiceFolders>
-        <stylesheetServiceUsers>umbraco</stylesheetServiceUsers>
-        <memberServiceUsers>umbraco</memberServiceUsers>
-        <templateServiceUsers>umbraco</templateServiceUsers>
-    </webservices>
+  <!-- configuration for webservices -->
+  <!-- webservices are disabled by default. Set enable="True" to enable them -->
+  <webservices enabled="True">
+    <!-- You must set user-rights for each service. Enter the usernames seperated with comma (,) -->
+    <documentServiceUsers>umbraco</documentServiceUsers>
+    <fileServiceUsers>umbraco</fileServiceUsers>
+    <fileServiceFolders>css,xslt</fileServiceFolders>
+    <stylesheetServiceUsers>umbraco</stylesheetServiceUsers>
+    <memberServiceUsers>umbraco</memberServiceUsers>
+    <templateServiceUsers>umbraco</templateServiceUsers>
+  </webservices>
 
-    <!-- Configuration for repositories -->
-    <!-- Add or remove repositories here. You will need the repository's unique key to be able to connect to it.-->
-    <repositories>
-        <repository name="Umbraco package Repository" guid="65194810-1f85-11dd-bd0b-0800200c9a66" />
-    </repositories>
+  <!-- Configuration for repositories -->
+  <!-- Add or remove repositories here. You will need the repository's unique key to be able to connect to it.-->
+  <repositories>
+    <repository name="Umbraco package Repository" guid="65194810-1f85-11dd-bd0b-0800200c9a66" />
+  </repositories>
 
-    <providers>
-        <users>
-            <!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
-            <!-- specify it here (remember to add it to the web.config as well) -->
-            <DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
-        </users>
-    </providers>
+  <providers>
+    <users>
+      <!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
+      <!-- specify it here (remember to add it to the web.config as well) -->
+      <DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
+    </users>
+  </providers>
 
-    <!-- Maps language, usertype, application and application_url to help pages -->
-    <help defaultUrl="http://our.umbraco.org/wiki/umbraco-help/{0}/{1}">
-        <!-- Add links that should open custom help pages -->
-        <!--<link application="content" applicationUrl="dashboard.aspx"  language="en" userType="Administrators" helpUrl="http://www.xyz.no?{0}/{1}/{2}/{3}" /> -->
-    </help>
+  <!-- Maps language, usertype, application and application_url to help pages -->
+  <help defaultUrl="http://our.umbraco.org/wiki/umbraco-help/{0}/{1}">
+    <!-- Add links that should open custom help pages -->
+    <!--<link application="content" applicationUrl="dashboard.aspx"  language="en" userType="Administrators" helpUrl="http://www.xyz.no?{0}/{1}/{2}/{3}" /> -->
+  </help>
 
   <!-- 
     web.routing
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/en.xml b/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
index 35a20feb28..1dd9eba233 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/en.xml
@@ -228,6 +228,7 @@
     <key alias="errorRegExpWithoutTab">%0% is not in a correct format</key>
   </area>
   <area alias="errors">
+    <key alias="dissallowedMediaType">The specified file type has been dissallowed by the administrator</key>
     <key alias="codemirroriewarning">NOTE! Even though CodeMirror is enabled by configuration, it is disabled in Internet Explorer because it's not stable enough.</key>
     <key alias="contentTypeAliasAndNameNotNull">Please fill both alias and name on the new propertytype!</key>
     <key alias="filePermissionsError">There is a problem with read/write access to a specific file or folder</key>
diff --git a/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml b/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
index a43e1e3971..d880430c87 100644
--- a/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
+++ b/src/Umbraco.Web.UI/umbraco/config/lang/en_us.xml
@@ -227,6 +227,7 @@
     <key alias="errorRegExpWithoutTab">%0% is not in a correct format</key>
   </area>
   <area alias="errors">
+    <key alias="dissallowedMediaType">The specified file type has been dissallowed by the administrator</key>
     <key alias="codemirroriewarning">NOTE! Even though CodeMirror is enabled by configuration, it is disabled in Internet Explorer because it's not stable enough.</key>
     <key alias="contentTypeAliasAndNameNotNull">Please fill both alias and name on the new propertytype!</key>
     <key alias="filePermissionsError">There is a problem with read/write access to a specific file or folder</key>
diff --git a/src/umbraco.businesslogic/ApplicationTree.cs b/src/umbraco.businesslogic/ApplicationTree.cs
index 67faf9b7ec..d09484099b 100644
--- a/src/umbraco.businesslogic/ApplicationTree.cs
+++ b/src/umbraco.businesslogic/ApplicationTree.cs
@@ -5,8 +5,8 @@ using System.Linq;
 using System.Text;
 using System.Web;
 using System.Xml.Linq;
+using Umbraco.Core.IO;
 using umbraco.DataLayer;
-using umbraco.IO;
 
 namespace umbraco.BusinessLogic
 {
@@ -69,124 +69,71 @@ namespace umbraco.BusinessLogic
             get { return Application.SqlHelper; }
         }
 
-        private bool _silent;
         /// <summary>
         /// Gets or sets a value indicating whether this <see cref="ApplicationTree"/> is silent.
         /// </summary>
         /// <value><c>true</c> if silent; otherwise, <c>false</c>.</value>
-        public bool Silent
-        {
-            get { return _silent; }
-            set { _silent = value; }
-        }
+        public bool Silent { get; set; }
 
-        private bool _initialize;
         /// <summary>
         /// Gets or sets a value indicating whether this <see cref="ApplicationTree"/> should initialize.
         /// </summary>
         /// <value><c>true</c> if initialize; otherwise, <c>false</c>.</value>
-        public bool Initialize
-        {
-            get { return _initialize; }
-            set { _initialize = value; }
-        }
+        public bool Initialize { get; set; }
 
-        private byte _sortOrder;
         /// <summary>
         /// Gets or sets the sort order.
         /// </summary>
         /// <value>The sort order.</value>
-        public byte SortOrder
-        {
-            get { return _sortOrder; }
-            set { _sortOrder = value; }
-        }
+        public byte SortOrder { get; set; }
 
-        private string _applicationAlias;
         /// <summary>
         /// Gets the application alias.
         /// </summary>
         /// <value>The application alias.</value>
-        public string ApplicationAlias
-        {
-            get { return _applicationAlias; }
-        }
+        public string ApplicationAlias { get; private set; }
 
-        private string _alias;
         /// <summary>
         /// Gets the tree alias.
         /// </summary>
         /// <value>The alias.</value>
-        public string Alias
-        {
-            get { return _alias; }
-        }
+        public string Alias { get; private set; }
 
-        private string _title;
         /// <summary>
         /// Gets or sets the tree title.
         /// </summary>
         /// <value>The title.</value>
-        public string Title
-        {
-            get { return _title; }
-            set { _title = value; }
-        }
+        public string Title { get; set; }
 
-        private string _iconClosed;
         /// <summary>
         /// Gets or sets the icon closed.
         /// </summary>
         /// <value>The icon closed.</value>
-        public string IconClosed
-        {
-            get { return _iconClosed; }
-            set { _iconClosed = value; }
-        }
+        public string IconClosed { get; set; }
 
-        private string _iconOpened;
         /// <summary>
         /// Gets or sets the icon opened.
         /// </summary>
         /// <value>The icon opened.</value>
-        public string IconOpened
-        {
-            get { return _iconOpened; }
-            set { _iconOpened = value; }
-        }
+        public string IconOpened { get; set; }
 
-        private string _assemblyName;
         /// <summary>
         /// Gets or sets the name of the assembly.
         /// </summary>
         /// <value>The name of the assembly.</value>
-        public string AssemblyName
-        {
-            get { return _assemblyName; }
-            set { _assemblyName = value; }
-        }
+        public string AssemblyName { get; set; }
 
-        private string _type;
         /// <summary>
         /// Gets or sets the tree type.
         /// </summary>
         /// <value>The type.</value>
-        public string Type
-        {
-            get { return _type; }
-            set { _type = value; }
-        }
+        public string Type { get; set; }
 
-        private string _action;
         /// <summary>
         /// Gets or sets the default tree action.
         /// </summary>
         /// <value>The action.</value>
-        public string Action
-        {
-            get { return _action; }
-            set { _action = value; }
-        }        
+        public string Action { get; set; }
 
         /// <summary>
         /// Initializes a new instance of the <see cref="ApplicationTree"/> class.
@@ -210,17 +157,17 @@ namespace umbraco.BusinessLogic
         /// <param name="action">The default tree action.</param>
         public ApplicationTree(bool silent, bool initialize, byte sortOrder, string applicationAlias, string alias, string title, string iconClosed, string iconOpened, string assemblyName, string type, string action)
         {
-            this._silent = silent;
-            this._initialize = initialize;
-            this._sortOrder = sortOrder;
-            this._applicationAlias = applicationAlias;
-            this._alias = alias;
-            this._title = title;
-            this._iconClosed = iconClosed;
-            this._iconOpened = iconOpened;
-            this._assemblyName = assemblyName;
-            this._type = type;
-            this._action = action;
+            this.Silent = silent;
+            this.Initialize = initialize;
+            this.SortOrder = sortOrder;
+            this.ApplicationAlias = applicationAlias;
+            this.Alias = alias;
+            this.Title = title;
+            this.IconClosed = iconClosed;
+            this.IconOpened = iconOpened;
+            this.AssemblyName = assemblyName;
+            this.Type = type;
+            this.Action = action;
         }
 
 
@@ -453,8 +400,8 @@ namespace umbraco.BusinessLogic
                                 }))
                         {
                             list.Add(new ApplicationTree(
-                                             addElement.Attribute("silent") != null ? Convert.ToBoolean(addElement.Attribute("silent").Value) : false,
-                                             addElement.Attribute("initialize") != null ? Convert.ToBoolean(addElement.Attribute("initialize").Value) : true,
+                                             addElement.Attribute("silent") != null && Convert.ToBoolean(addElement.Attribute("silent").Value),
+                                             addElement.Attribute("initialize") == null || Convert.ToBoolean(addElement.Attribute("initialize").Value),
                                              addElement.Attribute("sortOrder") != null ? Convert.ToByte(addElement.Attribute("sortOrder").Value) : (byte)0,
                                              addElement.Attribute("application").Value,
                                              addElement.Attribute("alias").Value,
diff --git a/src/umbraco.businesslogic/UmbracoSettings.cs b/src/umbraco.businesslogic/UmbracoSettings.cs
index 1e206dcc16..e7d57b5d7b 100644
--- a/src/umbraco.businesslogic/UmbracoSettings.cs
+++ b/src/umbraco.businesslogic/UmbracoSettings.cs
@@ -282,6 +282,13 @@ namespace umbraco
 			get { return Umbraco.Core.Configuration.UmbracoSettings.ForceSafeAliases; }
         }
 
+        /// <summary>
+        /// File types that will not be allowed to be uploaded via the content/media upload control
+        /// </summary>
+        public static IEnumerable<string> DissallowedUploadFiles
+        {
+            get { return Umbraco.Core.Configuration.UmbracoSettings.DissallowedUploadFiles; }
+        }
 
         /// <summary>
         /// Gets the allowed image file types.
diff --git a/src/umbraco.editorControls/uploadfield/uploadField.cs b/src/umbraco.editorControls/uploadfield/uploadField.cs
index 933fffd8a1..3e23b9637e 100644
--- a/src/umbraco.editorControls/uploadfield/uploadField.cs
+++ b/src/umbraco.editorControls/uploadfield/uploadField.cs
@@ -1,12 +1,14 @@
 using System;
 using System.IO;
+using System.Linq;
 using System.Text.RegularExpressions;
+using System.Web;
 using System.Web.UI;
 using System.Web.UI.HtmlControls;
 using System.Web.UI.WebControls;
 using Umbraco.Core.IO;
 using umbraco.interfaces;
-using umbraco.IO;
+using Umbraco.Core;
 using Content = umbraco.cms.businesslogic.Content;
 
 namespace umbraco.editorControls
@@ -14,12 +16,13 @@ namespace umbraco.editorControls
     [ValidationProperty("IsValid")]
     public class uploadField : HtmlInputFile, IDataEditor
     {
-        private const String _thumbnailext = ".jpg";
+        private const string Thumbnailext = ".jpg";
         private readonly cms.businesslogic.datatype.DefaultData _data;
-        private readonly String _thumbnails;
-        private String _text;
+        private readonly string _thumbnails;
+        private string _text;
+        private CustomValidator _customValidator;
 
-        private MediaFileSystem _fs; 
+        private readonly MediaFileSystem _fs; 
 
         public uploadField(IData Data, string ThumbnailSizes)
         {
@@ -28,29 +31,68 @@ namespace umbraco.editorControls
             _thumbnails = ThumbnailSizes;
         }
 
+
+        protected override void CreateChildControls()
+        {
+            base.CreateChildControls();
+
+            _customValidator = new CustomValidator
+                {
+                    EnableClientScript = false, 
+                    Display = ValidatorDisplay.Dynamic,
+                    ErrorMessage = ui.Text("errors", "dissallowedMediaType")
+                };
+            _customValidator.ErrorMessage += "<br/>";
+
+            //NOTE: it would be better to have this as a normal composite control but we don't want to 
+            // break compatibility so we cannot make this inherit from a different class than it already
+            // is, so now we have to hack this together and add this directly to the page validators collection
+            // since we cannot add it as a control to this one.
+            Page.Validators.Add(_customValidator);
+        }
+
         /// <summary>
         /// Internal logic for validation controls to detect whether or not it's valid (has to be public though) 
         /// </summary>
-        /// <value>Am I valid?</value>
+        /// <value>Am I valid?</value>   
+        /// <remarks>
+        /// This is used for the required and regex validation of a document type's property
+        /// </remarks>     
         public string IsValid
         {
             get
             {
-                string tempText = Text;
-                bool isEmpty = PostedFile == null || String.IsNullOrEmpty(PostedFile.FileName);
+                var tempText = Text;
+                var isEmpty = PostedFile == null || string.IsNullOrEmpty(PostedFile.FileName);
                 // checkbox, if it's used the file will be deleted and we should throw a validation error
                 if (Page.Request[ClientID + "clear"] != null && Page.Request[ClientID + "clear"] != "")
                     return "";
-                else if (!isEmpty)
+                if (isEmpty == false)
                     return PostedFile.FileName;
-                else if (!String.IsNullOrEmpty(tempText))
-                    return tempText;
-                else
-                    return "";
+                return string.IsNullOrEmpty(tempText) == false 
+                    ? tempText 
+                    : "";
             }
         }
 
-        public String Text
+        /// <summary>
+        /// Checks if the file is valid based on our dissallowed file types
+        /// </summary>
+        /// <param name="postedFile"></param>
+        /// <returns></returns>
+        internal bool IsValidFile(HttpPostedFile postedFile)
+        {
+            //return true if there is no file
+            if (postedFile == null) return true;
+            if (postedFile.FileName.IsNullOrWhiteSpace()) return true;
+            
+            //now check the file type
+            var extension = Path.GetExtension(postedFile.FileName).TrimStart(".");
+            
+            return UmbracoSettings.DissallowedUploadFiles.Any(x => x.InvariantEquals(extension)) == false;
+        }
+
+        public string Text
         {
             get { return _text; }
             set { _text = value; }
@@ -79,14 +121,14 @@ namespace umbraco.editorControls
             if (helper.Request(ClientID + "clear") == "1")
             {
                 // delete file
-                deleteFile(_text);
+                DeleteFile(_text);
 
                 // set filename in db to nothing
                 _text = "";
                 _data.Value = _text;
 
 
-                foreach (string prop in "umbracoExtension,umbracoBytes,umbracoWidth,umbracoHeight".Split(','))
+                foreach (var prop in "umbracoExtension,umbracoBytes,umbracoWidth,umbracoHeight".Split(','))
                 {
                     try
                     {
@@ -104,61 +146,68 @@ namespace umbraco.editorControls
                 }
             }
 
-            if (PostedFile != null && PostedFile.FileName != String.Empty)
+            if (PostedFile == null || PostedFile.FileName == string.Empty) return;
+
+            //don't save if the file is invalid
+            if (IsValidFile(PostedFile) == false)
             {
-                _data.Value = PostedFile;
+                //set the validator to not valid
+                _customValidator.IsValid = false;
+                return;
+            }
 
-                // we update additional properties post image upload
-                if (_data.Value != DBNull.Value && !string.IsNullOrEmpty(_data.Value.ToString()))
+            _data.Value = PostedFile;
+
+            // we update additional properties post image upload
+            if (_data.Value != DBNull.Value && string.IsNullOrEmpty(_data.Value.ToString()) == false)
+            {
+                var content = Content.GetContentFromVersion(_data.Version);
+
+                // update extension in UI
+                try
                 {
-                    Content content = Content.GetContentFromVersion(_data.Version);
-
-                    // update extension in UI
-                    try
-                    {
-                        var extensionControl = FindControlRecursive<noEdit>(Page, "prop_umbracoExtension");
-                        if (extensionControl != null)
-                        {
-                            extensionControl.RefreshLabel(content.getProperty("umbracoExtension").Value.ToString());
-                        }
-                    }
-                    catch
-                    {
-                    }
-
-
-                    // update file size in UI
-                    try
-                    {
-                        var bytesControl = FindControlRecursive<noEdit>(Page, "prop_umbracoBytes");
-                        if (bytesControl != null)
-                        {
-                            bytesControl.RefreshLabel(content.getProperty("umbracoBytes").Value.ToString());
-                        }
-                    }
-                    catch
-                    {
-                    }
-
-                    try
-                    {
-                        var widthControl = FindControlRecursive<noEdit>(Page, "prop_umbracoWidth");
-                        if (widthControl != null)
-                        {
-                            widthControl.RefreshLabel(content.getProperty("umbracoWidth").Value.ToString());
-                        }
-                        var heightControl = FindControlRecursive<noEdit>(Page, "prop_umbracoHeight");
-                        if (heightControl != null)
-                        {
-                            heightControl.RefreshLabel(content.getProperty("umbracoHeight").Value.ToString());
-                        }
-                    }
-                    catch
+                    var extensionControl = FindControlRecursive<noEdit>(Page, "prop_umbracoExtension");
+                    if (extensionControl != null)
                     {
+                        extensionControl.RefreshLabel(content.getProperty("umbracoExtension").Value.ToString());
                     }
                 }
-                Text = _data.Value.ToString();
+                catch
+                {
+                }
+
+
+                // update file size in UI
+                try
+                {
+                    var bytesControl = FindControlRecursive<noEdit>(Page, "prop_umbracoBytes");
+                    if (bytesControl != null)
+                    {
+                        bytesControl.RefreshLabel(content.getProperty("umbracoBytes").Value.ToString());
+                    }
+                }
+                catch
+                {
+                }
+
+                try
+                {
+                    var widthControl = FindControlRecursive<noEdit>(Page, "prop_umbracoWidth");
+                    if (widthControl != null)
+                    {
+                        widthControl.RefreshLabel(content.getProperty("umbracoWidth").Value.ToString());
+                    }
+                    var heightControl = FindControlRecursive<noEdit>(Page, "prop_umbracoHeight");
+                    if (heightControl != null)
+                    {
+                        heightControl.RefreshLabel(content.getProperty("umbracoHeight").Value.ToString());
+                    }
+                }
+                catch
+                {
+                }
             }
+            Text = _data.Value.ToString();
         }
 
         #endregion
@@ -166,20 +215,20 @@ namespace umbraco.editorControls
         [Obsolete("This method is now obsolete due to a change in the way that files are handled.  If you need to check if a URL for an uploaded file is safe you should implement your own as this method will be removed in a future version", false)]
         public string SafeUrl(string url)
         {
-            if (!String.IsNullOrEmpty(url))
-                return Regex.Replace(url, @"[^a-zA-Z0-9\-\.\/\:]{1}", "_");
-            else
-                return String.Empty;
+            return string.IsNullOrEmpty(url) == false 
+                ? Regex.Replace(url, @"[^a-zA-Z0-9\-\.\/\:]{1}", "_") 
+                : String.Empty;
         }
 
         protected override void OnInit(EventArgs e)
         {
+            EnsureChildControls();
             base.OnInit(e);
             if (_data != null && _data.Value != null)
                 Text = _data.Value.ToString();
         }
 
-        private void deleteFile(string fileUrl)
+        private void DeleteFile(string fileUrl)
         {
             if (fileUrl.Length > 0)
             {
@@ -189,7 +238,7 @@ namespace umbraco.editorControls
                 if (_fs.FileExists(relativeFilePath))
                     _fs.DeleteFile(relativeFilePath);
 
-                string extension = (relativeFilePath.Substring(relativeFilePath.LastIndexOf(".") + 1, relativeFilePath.Length - relativeFilePath.LastIndexOf(".") - 1));
+                var extension = (relativeFilePath.Substring(relativeFilePath.LastIndexOf(".") + 1, relativeFilePath.Length - relativeFilePath.LastIndexOf(".") - 1));
                 extension = extension.ToLower();
 
                 //check for thumbnails
@@ -200,8 +249,8 @@ namespace umbraco.editorControls
 
                     try
                     {
-                        if (_fs.FileExists(relativeThumbFilePath + _thumbnailext))
-                            _fs.DeleteFile(relativeThumbFilePath + _thumbnailext);
+                        if (_fs.FileExists(relativeThumbFilePath + Thumbnailext))
+                            _fs.DeleteFile(relativeThumbFilePath + Thumbnailext);
                     }
                     catch
                     {
@@ -209,12 +258,12 @@ namespace umbraco.editorControls
 
                     if (_thumbnails != "")
                     {
-                        string[] thumbnailSizes = _thumbnails.Split(";".ToCharArray());
-                        foreach (string thumb in thumbnailSizes)
+                        var thumbnailSizes = _thumbnails.Split(";".ToCharArray());
+                        foreach (var thumb in thumbnailSizes)
                         {
                             if (thumb != "")
                             {
-                                string relativeExtraThumbFilePath = relativeThumbFilePath + "_" + thumb + _thumbnailext;
+                                string relativeExtraThumbFilePath = relativeThumbFilePath + "_" + thumb + Thumbnailext;
 
                                 try
                                 {
@@ -271,7 +320,16 @@ namespace umbraco.editorControls
         /// <param name="output"> The HTML writer to write out to </param>
         protected override void Render(HtmlTextWriter output)
         {
-            if (!string.IsNullOrEmpty(Text))
+            //render the validator if it is not valid
+            //NOTE: it would be better to have this as a normal composite control but we don't want to 
+            // break compatibility so we cannot make this inherit from a different class than it already
+            // is, so now we have to hack this together.     
+            if (_customValidator.IsValid == false)
+            {
+                _customValidator.RenderControl(output);
+            }
+
+            if (string.IsNullOrEmpty(Text) == false)
             {
                 var relativeFilePath = _fs.GetRelativePath(_text);
                 var ext = relativeFilePath.Substring(relativeFilePath.LastIndexOf(".") + 1, relativeFilePath.Length - relativeFilePath.LastIndexOf(".") - 1);
@@ -281,7 +339,7 @@ namespace umbraco.editorControls
                 {
                     hasThumb = _fs.FileExists(relativeThumbFilePath);
                     // 4.8.0 added support for png thumbnails (but for legacy it might have been jpg - hence the check before)
-                    if (!hasThumb && (ext == "gif" || ext == "png"))
+                    if (hasThumb == false && (ext == "gif" || ext == "png"))
                     {
                         relativeThumbFilePath = relativeFilePath.Replace("." + ext, "_thumb.png");
                         hasThumb = _fs.FileExists(relativeThumbFilePath);