From 601eb0bf38c9251e7c87bc22af657bc4039c57c8 Mon Sep 17 00:00:00 2001
From: Shannon <sdeminick@gmail.com>
Date: Tue, 3 Dec 2013 16:28:51 +1100
Subject: [PATCH] Fixes a few other potential xss entry points and cleans up
 some legacy webforms files

---
 .../developer/Xslt/xsltChooseExtension.aspx   |  27 ++-
 .../developer/Xslt/xsltInsertValueOf.aspx     |   5 +-
 .../umbraco/dialogs/AssignDomain.aspx         |   5 +-
 .../umbraco/dialogs/create.aspx               |  13 +-
 src/Umbraco.Web/Umbraco.Web.csproj            |  26 +--
 .../umbraco/dialogs/AssignDomain.aspx         |  48 -----
 .../umbraco/dialogs/AssignDomain.aspx.cs      | 180 ++++++++++++++----
 .../dialogs/AssignDomain.aspx.designer.cs     | 123 ------------
 .../umbraco/dialogs/create.aspx               |  66 -------
 .../umbraco/dialogs/create.aspx.cs            | 151 +++++++++++----
 .../umbraco/dialogs/create.aspx.designer.cs   |  79 --------
 11 files changed, 293 insertions(+), 430 deletions(-)
 delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx
 delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.designer.cs
 delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx
 delete mode 100644 src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.designer.cs

diff --git a/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltChooseExtension.aspx b/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltChooseExtension.aspx
index a127ead2d5..2540c5290a 100644
--- a/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltChooseExtension.aspx
+++ b/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltChooseExtension.aspx
@@ -1,23 +1,22 @@
 <%@ Page Language="c#" Codebehind="xsltChooseExtension.aspx.cs" MasterPageFile="../../masterpages/umbracoDialog.Master"  AutoEventWireup="True"
   Inherits="umbraco.developer.xsltChooseExtension" %>
-  <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
+<%@ Import Namespace="Umbraco.Web" %>  <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
   
 <asp:Content ContentPlaceHolderID="head" runat="server">
     <script type="text/javascript">
-      function returnResult() {
-        result = document.getElementById('<%= assemblies.ClientID %>').value + ":" + document.getElementById('selectedMethod').value + "(";
-        for (var i = 0; i < document.forms[0].length - 1; i++) {
-          if (document.forms[0][i].name.indexOf('param') > -1)
-            result = result + "'" + document.forms[0][i].value + "', "
+        function returnResult() {
+            var result = document.getElementById('<%= assemblies.ClientID %>').value + ":" + document.getElementById('selectedMethod').value + "(";
+            for (var i = 0; i < document.forms[0].length - 1; i++) {
+                if (document.forms[0][i].name.indexOf('param') > -1)
+                    result = result + "'" + document.forms[0][i].value + "', ";
+            }
+            if (result.substring(result.length - 1, result.length) == " ")
+                result = result.substring(0, result.length - 2);
+            result = result + ")";
+            
+            document.location = 'xsltInsertValueOf.aspx?objectId=<%=Request.GetCleanedItem("objectId")%>&value=' + result;
         }
-        if (result.substring(result.length - 1, result.length) == " ")
-          result = result.substring(0, result.length - 2);
-        result = result + ")"
-
-
-        document.location = 'xsltInsertValueOf.aspx?objectId=<%=umbraco.helper.Request("objectId")%>&value=' + result;
-      }
-</script>
+    </script>
 
 <style type="text/css">
 div.code{padding: 7px 0px 7px 0px;  font-family: Consolas,courier;}
diff --git a/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltInsertValueOf.aspx b/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltInsertValueOf.aspx
index f5188b41ac..4a206a04b2 100644
--- a/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltInsertValueOf.aspx
+++ b/src/Umbraco.Web.UI/umbraco/developer/Xslt/xsltInsertValueOf.aspx
@@ -1,4 +1,5 @@
 <%@ Page Language="c#" MasterPageFile="../../masterpages/umbracoDialog.Master" Codebehind="xsltInsertValueOf.aspx.cs" AutoEventWireup="True"  Inherits="umbraco.developer.xsltInsertValueOf" %>
+<%@ Import Namespace="Umbraco.Web" %>
 <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
 <%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
 
@@ -13,13 +14,13 @@
     result = '<xsl:value-of select="' + document.getElementById('<%= valueOf.ClientID %>').value + '"' + checked + '/>';
 
     UmbClientMgr.contentFrame().focus();
-    UmbClientMgr.contentFrame().UmbEditor.Insert(result, '', '<%=umbraco.helper.Request("objectId")%>');
+    UmbClientMgr.contentFrame().UmbEditor.Insert(result, '', '<%=Request.GetCleanedItem("objectId")%>');
 
     UmbClientMgr.closeModalWindow();
   }
 
   function getExtensionMethod() {
-    document.location = 'xsltChooseExtension.aspx?objectId=<%=umbraco.helper.Request("objectId")%>';
+    document.location = 'xsltChooseExtension.aspx?objectId=<%=Request.GetCleanedItem("objectId")%>';
   }
 
   function recieveExtensionMethod(theValue) {
diff --git a/src/Umbraco.Web.UI/umbraco/dialogs/AssignDomain.aspx b/src/Umbraco.Web.UI/umbraco/dialogs/AssignDomain.aspx
index a2ecac4be2..8bee1cd9b4 100644
--- a/src/Umbraco.Web.UI/umbraco/dialogs/AssignDomain.aspx
+++ b/src/Umbraco.Web.UI/umbraco/dialogs/AssignDomain.aspx
@@ -1,9 +1,9 @@
-<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" Codebehind="AssignDomain.aspx.cs" AutoEventWireup="True" Inherits="umbraco.dialogs.AssignDomain" %>
+<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" AutoEventWireup="True" Inherits="umbraco.dialogs.AssignDomain" %>
 <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
 
 <asp:Content ContentPlaceHolderID="head" runat="server">
 <script type="text/javascript">
-	function doSubmit() {document.Form1["ok"].click()}
+    function doSubmit() { document.Form1["ok"].click(); }
 	var functionsFrame = this;
 	var tabFrame = this;
 	var isDialog = true;
@@ -14,7 +14,6 @@
 </asp:Content>
 
 <asp:Content ContentPlaceHolderID="body" runat="server">
-    <input type="hidden" name="domainId" value="<%=umbraco.helper.Request("editDomain")%>" />
     
     <cc1:Feedback ID="FeedBackMessage" runat="server" />
     
diff --git a/src/Umbraco.Web.UI/umbraco/dialogs/create.aspx b/src/Umbraco.Web.UI/umbraco/dialogs/create.aspx
index 92e1b86ed3..17b231f923 100644
--- a/src/Umbraco.Web.UI/umbraco/dialogs/create.aspx
+++ b/src/Umbraco.Web.UI/umbraco/dialogs/create.aspx
@@ -1,6 +1,7 @@
-<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" CodeBehind="create.aspx.cs"
+<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" 
     AutoEventWireup="True" Inherits="umbraco.dialogs.create" %>
 
+<%@ Import Namespace="Umbraco.Web" %>
 <%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
 <%@ Register Src="../controls/Tree/TreeControl.ascx" TagName="TreeControl" TagPrefix="umbraco" %>
 <asp:Content ContentPlaceHolderID="head" runat="server">
@@ -20,10 +21,10 @@
 			document.getElementById("ok").disabled = false;
 			// Get node name by xmlrequest
 			if (id > 0) {
-			    umbraco.presentation.webservices.CMSNode.GetNodeName('<%=umbraco.BasePages.BasePage.umbracoUserContextID%>', id, updateName);
+			    umbraco.presentation.webservices.CMSNode.GetNodeName('<%=umbracoUserContextID%>', id, updateName);
 				}
 			else			
-				pageName.html("<p><strong><%=umbraco.ui.Text(umbraco.helper.Request("app"))%></strong> <%= umbraco.ui.Text("moveOrCopy","nodeSelected") %></p>");
+				pageName.html("<p><strong><%=umbraco.ui.Text(App)%></strong> <%= umbraco.ui.Text("moveOrCopy","nodeSelected") %></p>");
 				pageNameHolder.attr("class","success");
 		}
 		
@@ -33,17 +34,17 @@
 		}
 		
 		function onNodeSelectionConfirmed() {
-		    document.location.href = 'create.aspx?nodeType=<%=umbraco.helper.Request("nodeType")%>&app=<%=umbraco.helper.Request("app")%>&nodeId=' + document.getElementById('nodeId').value
+		    document.location.href = 'create.aspx?nodeType=<%=Request.GetCleanedItem("nodeType")%>&app=<%=App%>&nodeId=' + document.getElementById('nodeId').value
 		}
 	
     </script>
 
 </asp:Content>
 <asp:Content ContentPlaceHolderID="body" runat="server">
-    <input type="hidden" id="nodeId" name="nodeId" value="<%=umbraco.helper.Request("nodeId")%>" />
+    <input type="hidden" id="nodeId" name="nodeId" value="<%=Request.GetCleanedItem("nodeId")%>" />
     <input type="hidden" id="path" name="path" value="" runat="server" />
     <cc1:Pane ID="pane_chooseNode" runat="server" Style="overflow: auto; height: 250px;">
-        <umbraco:TreeControl runat="server" ID="JTree" App='<%#umbraco.helper.Request("app") %>'
+        <umbraco:TreeControl runat="server" ID="JTree" App='<%#App %>'
             IsDialog="true" DialogMode="id" ShowContextMenu="false" FunctionToCall="dialogHandler"
             Height="230"></umbraco:TreeControl>
     </cc1:Pane>
diff --git a/src/Umbraco.Web/Umbraco.Web.csproj b/src/Umbraco.Web/Umbraco.Web.csproj
index ca1ca85347..6592cfd264 100644
--- a/src/Umbraco.Web/Umbraco.Web.csproj
+++ b/src/Umbraco.Web/Umbraco.Web.csproj
@@ -399,6 +399,12 @@
     <Compile Include="umbraco.presentation\umbraco\developer\Packages\directoryBrowser.aspx.cs">
       <SubType>ASPXCodeBehind</SubType>
     </Compile>
+    <Compile Include="umbraco.presentation\umbraco\dialogs\create.aspx.cs">
+      <SubType>ASPXCodeBehind</SubType>
+    </Compile>
+    <Compile Include="umbraco.presentation\umbraco\dialogs\AssignDomain.aspx.cs">
+      <SubType>ASPXCodeBehind</SubType>
+    </Compile>
     <Compile Include="umbraco.presentation\umbraco\dialogs\AssignDomain2.aspx.cs">
       <DependentUpon>AssignDomain2.aspx</DependentUpon>
       <SubType>ASPXCodeBehind</SubType>
@@ -1261,20 +1267,6 @@
     <Compile Include="umbraco.presentation\umbraco\dialogs\about.aspx.designer.cs">
       <DependentUpon>about.aspx</DependentUpon>
     </Compile>
-    <Compile Include="umbraco.presentation\umbraco\dialogs\AssignDomain.aspx.cs">
-      <DependentUpon>AssignDomain.aspx</DependentUpon>
-      <SubType>ASPXCodeBehind</SubType>
-    </Compile>
-    <Compile Include="umbraco.presentation\umbraco\dialogs\AssignDomain.aspx.designer.cs">
-      <DependentUpon>AssignDomain.aspx</DependentUpon>
-    </Compile>
-    <Compile Include="umbraco.presentation\umbraco\dialogs\create.aspx.cs">
-      <DependentUpon>create.aspx</DependentUpon>
-      <SubType>ASPXCodeBehind</SubType>
-    </Compile>
-    <Compile Include="umbraco.presentation\umbraco\dialogs\create.aspx.designer.cs">
-      <DependentUpon>create.aspx</DependentUpon>
-    </Compile>
     <Compile Include="umbraco.presentation\umbraco\dialogs\cruds.aspx.cs">
       <DependentUpon>cruds.aspx</DependentUpon>
       <SubType>ASPXCodeBehind</SubType>
@@ -1881,12 +1873,6 @@
     <Content Include="umbraco.presentation\umbraco\dialogs\about.aspx">
       <SubType>ASPXCodeBehind</SubType>
     </Content>
-    <Content Include="umbraco.presentation\umbraco\dialogs\AssignDomain.aspx">
-      <SubType>ASPXCodeBehind</SubType>
-    </Content>
-    <Content Include="umbraco.presentation\umbraco\dialogs\create.aspx">
-      <SubType>ASPXCodeBehind</SubType>
-    </Content>
     <Content Include="umbraco.presentation\umbraco\dialogs\cruds.aspx" />
     <Content Include="umbraco.presentation\umbraco\dialogs\emptyTrashcan.aspx" />
     <Content Include="umbraco.presentation\umbraco\dialogs\exportDocumenttype.aspx" />
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx
deleted file mode 100644
index a2ecac4be2..0000000000
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx
+++ /dev/null
@@ -1,48 +0,0 @@
-<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" Codebehind="AssignDomain.aspx.cs" AutoEventWireup="True" Inherits="umbraco.dialogs.AssignDomain" %>
-<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
-
-<asp:Content ContentPlaceHolderID="head" runat="server">
-<script type="text/javascript">
-	function doSubmit() {document.Form1["ok"].click()}
-	var functionsFrame = this;
-	var tabFrame = this;
-	var isDialog = true;
-	var submitOnEnter = true;
-	</script>
-
-
-</asp:Content>
-
-<asp:Content ContentPlaceHolderID="body" runat="server">
-    <input type="hidden" name="domainId" value="<%=umbraco.helper.Request("editDomain")%>" />
-    
-    <cc1:Feedback ID="FeedBackMessage" runat="server" />
-    
-    <cc1:Pane runat="server" ID="pane_addnew">
-      <cc1:PropertyPanel runat="server" ID="prop_domain" Text="Domain">
-         <asp:TextBox ID="DomainName" runat="server" Width="252px"></asp:TextBox>
-         <asp:RequiredFieldValidator ControlToValidate="DomainName" ErrorMessage="*" ID="DomainValidator" runat="server" Display="Dynamic" />
-         <asp:RegularExpressionValidator ControlToValidate="DomainName" ErrorMessage="*" ID="DomainValidator2" runat="server" Display="Dynamic" /> 
-         <br /><small><%= umbraco.ui.Text("assignDomain", "domainHelp") %></small>
-      </cc1:PropertyPanel>
-      
-      <cc1:PropertyPanel ID="prop_lang" runat="server" Text="language">
-        <asp:DropDownList ID="Languages" runat="server" />
-        <asp:RequiredFieldValidator ControlToValidate="Languages" ErrorMessage="*" ID="LanguageValidator" runat="server" Display="Dynamic" />
-      </cc1:PropertyPanel>
-      
-      <cc1:PropertyPanel runat="server" Text=" ">
-        <asp:Button ID="ok" runat="server" OnClick="SaveDomain"></asp:Button> 
-      </cc1:PropertyPanel>
-    </cc1:Pane>
-    
-    <cc1:Pane ID="pane_edit" runat="server">
-      <cc1:PropertyPanel runat="server">
-                <asp:Literal ID="allDomains" runat="server" />
-      </cc1:PropertyPanel> 
-    </cc1:Pane>
-    
-    <p>
-      <a href="#" onclick="UmbClientMgr.closeModalWindow()"><%= umbraco.ui.Text("defaultdialogs", "closeThisWindow")%></a>
-    </p>
-</asp:Content>
\ No newline at end of file
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.cs
index 27d0742baa..0507a6e321 100644
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.cs
+++ b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.cs
@@ -1,5 +1,7 @@
-using System;
+using System;
+using System.Globalization;
 using System.Web.UI.WebControls;
+using Umbraco.Web;
 using umbraco.BasePages;
 using umbraco.BusinessLogic;
 using umbraco.cms.businesslogic.language;
@@ -22,23 +24,22 @@ namespace umbraco.dialogs
 
         protected void Page_Load(object sender, EventArgs e)
         {
-            _currentId = int.Parse(helper.Request("id"));
-            prop_domain.Text = ui.Text("assignDomain", "domain", this.getUser());
-            prop_lang.Text = ui.Text("general", "language", this.getUser());
-            pane_addnew.Text = ui.Text("assignDomain", "addNew", this.getUser());
-            pane_edit.Text = ui.Text("assignDomain", "orEdit", this.getUser());
-            
-            // Put user code to initialize the page here
-            if (helper.Request("editDomain").Trim() != "")
+            _currentId = Request.GetItemAs<int>("id");
+            prop_domain.Text = ui.Text("assignDomain", "domain", UmbracoUser);
+            prop_lang.Text = ui.Text("general", "language", UmbracoUser);
+            pane_addnew.Text = ui.Text("assignDomain", "addNew", UmbracoUser);
+            pane_edit.Text = ui.Text("assignDomain", "orEdit", UmbracoUser);
+
+            if (Request.GetItemAsString("editDomain").Trim() != "")
             {
-                _editDomain = int.Parse(helper.Request("editDomain"));
+                _editDomain = Request.GetItemAs<int>("editDomain");
             }
 
-            if (helper.Request("delDomain").Trim() != "")
+            if (Request.GetItemAsString("delDomain").Trim() != "")
             {
-                var d = new Domain(int.Parse(helper.Request("delDomain")));
+                var d = new Domain(Request.GetItemAs<int>("delDomain"));
                 FeedBackMessage.type = uicontrols.Feedback.feedbacktype.success;
-                FeedBackMessage.Text = ui.Text("assignDomain", "domainDeleted", d.Name, getUser());
+                FeedBackMessage.Text = ui.Text("assignDomain", "domainDeleted", d.Name, UmbracoUser);
                 d.Delete();
                 UpdateDomainList();
             }
@@ -46,8 +47,8 @@ namespace umbraco.dialogs
             if (!IsPostBack)
             {
                 // Add caption to button
-                ok.Text = ui.Text("assignDomain", "addNew", getUser());
-              
+                ok.Text = ui.Text("assignDomain", "addNew", UmbracoUser);
+
                 var selectedLanguage = -1;
 
                 // Maybe add editing info - not the best way this is made ;-)
@@ -55,24 +56,24 @@ namespace umbraco.dialogs
                 {
                     var d = new Domain(_editDomain);
                     selectedLanguage = d.Language.id;
-					DomainName.Text = d.Name.StartsWith("*") ? "*" : d.Name;
-                    ok.Text = ui.Text("general", "update", getUser());
+                    DomainName.Text = d.Name.StartsWith("*") ? "*" : d.Name;
+                    ok.Text = ui.Text("general", "update", UmbracoUser);
                 }
 
                 // Add caption to language validator
-                LanguageValidator.ErrorMessage = ui.Text("defaultdialogs", "requiredField", base.getUser()) + "<br/>";
-                DomainValidator.ErrorMessage = ui.Text("defaultdialogs", "requiredField", base.getUser());
+                LanguageValidator.ErrorMessage = ui.Text("defaultdialogs", "requiredField", UmbracoUser) + "<br/>";
+                DomainValidator.ErrorMessage = ui.Text("defaultdialogs", "requiredField", UmbracoUser);
 
-				DomainValidator2.ErrorMessage = ui.Text("assignDomain", "invalidDomain", base.getUser());
-				//DomainValidator2.ValidationExpression = @"^(?i:http[s]?://)?([-\w]+(\.[-\w]+)*)(:\d+)?(/[-\w]*)?$";
-				DomainValidator2.ValidationExpression = @"^(\*|((?i:http[s]?://)?([-\w]+(\.[-\w]+)*)(:\d+)?(/[-\w]*)?))$";
+                DomainValidator2.ErrorMessage = ui.Text("assignDomain", "invalidDomain", UmbracoUser);
+                //DomainValidator2.ValidationExpression = @"^(?i:http[s]?://)?([-\w]+(\.[-\w]+)*)(:\d+)?(/[-\w]*)?$";
+                DomainValidator2.ValidationExpression = @"^(\*|((?i:http[s]?://)?([-\w]+(\.[-\w]+)*)(:\d+)?(/[-\w]*)?))$";
 
-                Languages.Items.Add(new ListItem(ui.Text("general", "choose", base.getUser()), ""));
-                foreach (var l in Language.getAll)
+                Languages.Items.Add(new ListItem(ui.Text("general", "choose", UmbracoUser), ""));
+                foreach (var l in Language.GetAllAsList())
                 {
                     var li = new ListItem();
                     li.Text = l.FriendlyName;
-                    li.Value = l.id.ToString();
+                    li.Value = l.id.ToString(CultureInfo.InvariantCulture);
                     if (selectedLanguage == l.id)
                         li.Selected = true;
                     Languages.Items.Add(li);
@@ -84,7 +85,7 @@ namespace umbraco.dialogs
 
         private void UpdateDomainList()
         {
-            
+
             var domainList = Domain.GetDomainsById(_currentId);
 
             if (domainList.Length > 0)
@@ -95,9 +96,9 @@ namespace umbraco.dialogs
                 {
                     var name = d.Name.StartsWith("*") ? "*" : d.Name;
                     allDomains.Text += "<tr><td>" + name + "</td><td>(" + d.Language.CultureAlias + ")</td><td><a href=\"?id=" + _currentId + "&editDomain=" +
-                                       d.Id.ToString() + "\">" + ui.Text("edit") + "</a></td><td><a href=\"?id=" + _currentId +
-                                       "&delDomain=" + d.Id.ToString() + "\" onClick=\"return confirm('" +
-                                       ui.Text("defaultdialogs", "confirmdelete", base.getUser()) +
+                                       d.Id.ToString(CultureInfo.InvariantCulture) + "\">" + ui.Text("edit") + "</a></td><td><a href=\"?id=" + _currentId +
+                                       "&delDomain=" + d.Id.ToString(CultureInfo.InvariantCulture) + "\" onClick=\"return confirm('" +
+                                       ui.Text("defaultdialogs", "confirmdelete", UmbracoUser) +
                                        "');\" style=\"color: red\">" + ui.Text("delete") + "</a></td></tr>";
                 }
 
@@ -107,7 +108,7 @@ namespace umbraco.dialogs
             else
             {
                 pane_edit.Visible = false;
-            }            
+            }
         }
 
         protected void SaveDomain(object sender, EventArgs e)
@@ -120,7 +121,7 @@ namespace umbraco.dialogs
                     d.Language = new Language(int.Parse(Languages.SelectedValue));
                     d.Name = DomainName.Text.ToLower();
                     FeedBackMessage.type = uicontrols.Feedback.feedbacktype.success;
-                    FeedBackMessage.Text = ui.Text("assignDomain", "domainUpdated", DomainName.Text, getUser());
+                    FeedBackMessage.Text = ui.Text("assignDomain", "domainUpdated", DomainName.Text, UmbracoUser);
                     d.Save();
 
                     DomainName.Text = "";
@@ -132,14 +133,14 @@ namespace umbraco.dialogs
                 }
                 else
                 {
-					// have to handle wildcard
+                    // have to handle wildcard
                     var domainName = DomainName.Text.Trim();
-					domainName = domainName == "*" ? ("*" + _currentId.ToString()) : domainName;
+                    domainName = domainName == "*" ? ("*" + _currentId.ToString(CultureInfo.InvariantCulture)) : domainName;
 
                     if (!Domain.Exists(domainName.ToLower()))
                     {
                         Domain.MakeNew(domainName, _currentId, int.Parse(Languages.SelectedValue));
-                        FeedBackMessage.Text = ui.Text("assignDomain", "domainCreated", domainName, getUser());
+                        FeedBackMessage.Text = ui.Text("assignDomain", "domainCreated", domainName, UmbracoUser);
                         FeedBackMessage.type = uicontrols.Feedback.feedbacktype.success;
 
                         DomainName.Text = "";
@@ -151,12 +152,119 @@ namespace umbraco.dialogs
                     }
                     else
                     {
-                        FeedBackMessage.Text = ui.Text("assignDomain", "domainExists", DomainName.Text.Trim(), getUser());
+                        FeedBackMessage.Text = ui.Text("assignDomain", "domainExists", DomainName.Text.Trim(), UmbracoUser);
                         FeedBackMessage.type = uicontrols.Feedback.feedbacktype.error;
                     }
-                }   
+                }
             }
         }
 
+        /// <summary>
+        /// FeedBackMessage control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Feedback FeedBackMessage;
+
+        /// <summary>
+        /// pane_addnew control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Pane pane_addnew;
+
+        /// <summary>
+        /// prop_domain control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.PropertyPanel prop_domain;
+
+        /// <summary>
+        /// DomainName control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.TextBox DomainName;
+
+        /// <summary>
+        /// DomainValidator control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.RequiredFieldValidator DomainValidator;
+
+        /// <summary>
+        /// DomainValidator2 control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.RegularExpressionValidator DomainValidator2;
+
+        /// <summary>
+        /// prop_lang control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.PropertyPanel prop_lang;
+
+        /// <summary>
+        /// Languages control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.DropDownList Languages;
+
+        /// <summary>
+        /// LanguageValidator control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.RequiredFieldValidator LanguageValidator;
+
+        /// <summary>
+        /// ok control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Button ok;
+
+        /// <summary>
+        /// pane_edit control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Pane pane_edit;
+
+        /// <summary>
+        /// allDomains control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Literal allDomains;
     }
 }
\ No newline at end of file
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.designer.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.designer.cs
deleted file mode 100644
index 07464f0501..0000000000
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/AssignDomain.aspx.designer.cs
+++ /dev/null
@@ -1,123 +0,0 @@
-//------------------------------------------------------------------------------
-// <auto-generated>
-//     This code was generated by a tool.
-//
-//     Changes to this file may cause incorrect behavior and will be lost if
-//     the code is regenerated. 
-// </auto-generated>
-//------------------------------------------------------------------------------
-
-namespace umbraco.dialogs {
-    
-    
-    public partial class AssignDomain {
-        
-        /// <summary>
-        /// FeedBackMessage control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Feedback FeedBackMessage;
-        
-        /// <summary>
-        /// pane_addnew control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Pane pane_addnew;
-        
-        /// <summary>
-        /// prop_domain control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.PropertyPanel prop_domain;
-        
-        /// <summary>
-        /// DomainName control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.TextBox DomainName;
-        
-        /// <summary>
-        /// DomainValidator control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.RequiredFieldValidator DomainValidator;
-        
-        /// <summary>
-        /// DomainValidator2 control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.RegularExpressionValidator DomainValidator2;
-        
-        /// <summary>
-        /// prop_lang control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.PropertyPanel prop_lang;
-        
-        /// <summary>
-        /// Languages control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.DropDownList Languages;
-        
-        /// <summary>
-        /// LanguageValidator control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.RequiredFieldValidator LanguageValidator;
-        
-        /// <summary>
-        /// ok control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.Button ok;
-        
-        /// <summary>
-        /// pane_edit control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Pane pane_edit;
-        
-        /// <summary>
-        /// allDomains control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.Literal allDomains;
-    }
-}
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx
deleted file mode 100644
index 92e1b86ed3..0000000000
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx
+++ /dev/null
@@ -1,66 +0,0 @@
-<%@ Page Language="c#" MasterPageFile="../masterpages/umbracoDialog.Master" CodeBehind="create.aspx.cs"
-    AutoEventWireup="True" Inherits="umbraco.dialogs.create" %>
-
-<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
-<%@ Register Src="../controls/Tree/TreeControl.ascx" TagName="TreeControl" TagPrefix="umbraco" %>
-<asp:Content ContentPlaceHolderID="head" runat="server">
-
-    <script language="javascript" type="text/javascript">
-        
-        var pageNameHolder = null;
-        var pageName = null;
-        
-        jQuery(document).ready(function() {
-            pageNameHolder = jQuery("#<%=PageNameHolder.ClientID%>");
-		    pageName = pageNameHolder.find("p");    
-        });
-        
-		function dialogHandler(id) {
-			document.getElementById("nodeId").value = id;
-			document.getElementById("ok").disabled = false;
-			// Get node name by xmlrequest
-			if (id > 0) {
-			    umbraco.presentation.webservices.CMSNode.GetNodeName('<%=umbraco.BasePages.BasePage.umbracoUserContextID%>', id, updateName);
-				}
-			else			
-				pageName.html("<p><strong><%=umbraco.ui.Text(umbraco.helper.Request("app"))%></strong> <%= umbraco.ui.Text("moveOrCopy","nodeSelected") %></p>");
-				pageNameHolder.attr("class","success");
-		}
-		
-		function updateName(result) {			  
-		    pageName.html("<p><strong>" + result + "</strong> <%= umbraco.ui.Text("moveOrCopy","nodeSelected") %></p>");
-			pageNameHolder.attr("class","success");
-		}
-		
-		function onNodeSelectionConfirmed() {
-		    document.location.href = 'create.aspx?nodeType=<%=umbraco.helper.Request("nodeType")%>&app=<%=umbraco.helper.Request("app")%>&nodeId=' + document.getElementById('nodeId').value
-		}
-	
-    </script>
-
-</asp:Content>
-<asp:Content ContentPlaceHolderID="body" runat="server">
-    <input type="hidden" id="nodeId" name="nodeId" value="<%=umbraco.helper.Request("nodeId")%>" />
-    <input type="hidden" id="path" name="path" value="" runat="server" />
-    <cc1:Pane ID="pane_chooseNode" runat="server" Style="overflow: auto; height: 250px;">
-        <umbraco:TreeControl runat="server" ID="JTree" App='<%#umbraco.helper.Request("app") %>'
-            IsDialog="true" DialogMode="id" ShowContextMenu="false" FunctionToCall="dialogHandler"
-            Height="230"></umbraco:TreeControl>
-    </cc1:Pane>
-    <asp:Panel runat="server" ID="panel_buttons">
-        <cc1:Feedback runat="server" ID="PageNameHolder" type="notice" Style="margin-top: 10px;"
-            Text='<%#umbraco.ui.Text("moveOrCopy","noNodeSelected")%>' />
-        <div style="padding-top: 10px;" class="guiDialogNormal">
-            <input type="button" id="ok" value="<%=umbraco.ui.Text("ok")%>" onclick="onNodeSelectionConfirmed();"
-                disabled="true" style="width: 100px" />
-            &nbsp; <em>
-                <%= umbraco.ui.Text("or") %></em>&nbsp; <a href="#" style="color: blue" onclick="UmbClientMgr.closeModalWindow()">
-                    <%=umbraco.ui.Text("cancel")%></a>
-        </div>
-    </asp:Panel>
-    <cc1:Pane ID="pane_chooseName" Visible="false" runat="server">
-        <cc1:PropertyPanel runat="server">
-            <asp:PlaceHolder ID="phCreate" runat="server"></asp:PlaceHolder>
-        </cc1:PropertyPanel>
-    </cc1:Pane>
-</asp:Content>
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.cs
index 7bc9354816..761c9cbe2c 100644
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.cs
+++ b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.cs
@@ -1,8 +1,10 @@
-using System;
+using System;
 using System.Collections;
 using System.ComponentModel;
 using System.Data;
 using System.Drawing;
+using System.Globalization;
+using System.Linq;
 using System.Web;
 using System.Web.SessionState;
 using System.Web.UI;
@@ -10,7 +12,10 @@ using System.Web.UI.WebControls;
 using System.Web.UI.HtmlControls;
 using System.Xml;
 using Umbraco.Core.IO;
+using Umbraco.Core.Logging;
+using Umbraco.Web;
 using umbraco.cms.businesslogic;
+using umbraco.cms.presentation;
 using umbraco.presentation;
 using umbraco.BusinessLogic.Actions;
 using umbraco.BasePages;
@@ -19,31 +24,47 @@ using Umbraco.Core;
 
 namespace umbraco.dialogs
 {
-	/// <summary>
-	/// Summary description for create.
-	/// </summary>
-	public partial class create : BasePages.UmbracoEnsuredPage
-	{
-		protected System.Web.UI.WebControls.Button ok;
+    /// <summary>
+    /// Summary description for create.
+    /// </summary>
+    public partial class create : UmbracoEnsuredPage
+    {
+        protected Button ok;
 
-		protected void Page_Load(object sender, System.EventArgs e)
-		{
-			// Put user code to initialize the page here
-			if (helper.Request("nodeId") == "") 
-			{
-			
-				string appType = ui.Text("sections", helper.Request("app")).ToLower();
-                pane_chooseNode.Text = ui.Text("create", "chooseNode", appType, this.getUser()) + "?";
+        private string _app;
+        protected string App
+        {
+            get
+            {
+                if (_app == null)
+                {
+                    _app = Request.GetCleanedItem("app");
+                    //validate the app
+                    if (BusinessLogic.Application.getAll().Any(x => x.alias.InvariantEquals(_app)) == false)
+                    {
+                        throw new InvalidOperationException("A requested app: " + Request.GetItemAsString("app") + " was not found");
+                    }
+                }
+                return _app;
+            }
+        }
+
+        protected void Page_Load(object sender, EventArgs e)
+        {
+            // Put user code to initialize the page here
+            if (Request.GetItemAsString("nodeId") == "")
+            {
+                var appType = ui.Text("sections", App).ToLower();
+                pane_chooseNode.Text = ui.Text("create", "chooseNode", appType, UmbracoUser) + "?";
 
                 DataBind();
-			} 
-			else 
-			{
-                int nodeId = int.Parse(helper.Request("nodeId"));
+            }
+            else
+            {
+                int nodeId = Request.GetItemAs<int>("nodeId");
                 //ensure they have access to create under this node!!
-                if (helper.Request("app") == Constants.Applications.Media || CheckCreatePermissions(nodeId))
+                if (App.InvariantEquals(Constants.Applications.Media) || CheckCreatePermissions(nodeId))
                 {
-                    //pane_chooseName.Text = ui.Text("create", "updateData", this.getUser());
                     var c = new CMSNode(nodeId);
                     path.Value = c.Path;
                     pane_chooseNode.Visible = false;
@@ -55,31 +76,95 @@ namespace umbraco.dialogs
                     defReader.Close();
 
                     // Find definition for current nodeType
-                    XmlNode def = createDef.SelectSingleNode("//nodeType [@alias = '" + Request.QueryString["app"] + "']");
+                    XmlNode def = createDef.SelectSingleNode("//nodeType [@alias = '" + App + "']");
                     phCreate.Controls.Add(new UserControl().LoadControl(IOHelper.ResolveUrl(SystemDirectories.Umbraco) + def.SelectSingleNode("./usercontrol").FirstChild.Value));
                 }
                 else
-                {                    
-                    PageNameHolder.type = umbraco.uicontrols.Feedback.feedbacktype.error;
+                {
+                    PageNameHolder.type = uicontrols.Feedback.feedbacktype.error;
                     PageNameHolder.Text = ui.GetText("rights") + " " + ui.GetText("error");
                     JTree.DataBind();
                 }
-			}
-                        
-		}
+            }
 
-        protected override void OnPreRender(EventArgs e) {
+        }
+
+        protected override void OnPreRender(EventArgs e)
+        {
             base.OnPreRender(e);
 
-            ScriptManager.GetCurrent(Page).Services.Add(new ServiceReference( IOHelper.ResolveUrl( SystemDirectories.WebServices) +"/cmsnode.asmx"));
-            ScriptManager.GetCurrent(Page).Services.Add(new ServiceReference( IOHelper.ResolveUrl( SystemDirectories.WebServices) +"/legacyAjaxCalls.asmx"));
+            ScriptManager.GetCurrent(Page).Services.Add(new ServiceReference(IOHelper.ResolveUrl(SystemDirectories.WebServices) + "/cmsnode.asmx"));
+            ScriptManager.GetCurrent(Page).Services.Add(new ServiceReference(IOHelper.ResolveUrl(SystemDirectories.WebServices) + "/legacyAjaxCalls.asmx"));
         }
 
         private bool CheckCreatePermissions(int nodeId)
         {
-            return UmbracoEnsuredPage.CurrentUser.GetPermissions(new CMSNode(nodeId).Path)
-                .Contains(ActionNew.Instance.Letter.ToString());
+            return CurrentUser.GetPermissions(new CMSNode(nodeId).Path)
+                .Contains(ActionNew.Instance.Letter.ToString(CultureInfo.InvariantCulture));
         }
 
-	}
+
+        /// <summary>
+        /// path control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.HtmlControls.HtmlInputHidden path;
+
+        /// <summary>
+        /// pane_chooseNode control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Pane pane_chooseNode;
+
+        /// <summary>
+        /// JTree control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.controls.Tree.TreeControl JTree;
+
+        /// <summary>
+        /// panel_buttons control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.Panel panel_buttons;
+
+        /// <summary>
+        /// PageNameHolder control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Feedback PageNameHolder;
+
+        /// <summary>
+        /// pane_chooseName control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::umbraco.uicontrols.Pane pane_chooseName;
+
+        /// <summary>
+        /// phCreate control.
+        /// </summary>
+        /// <remarks>
+        /// Auto-generated field.
+        /// To modify move field declaration from designer file to code-behind file.
+        /// </remarks>
+        protected global::System.Web.UI.WebControls.PlaceHolder phCreate;
+    }
 }
diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.designer.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.designer.cs
deleted file mode 100644
index 980534866e..0000000000
--- a/src/Umbraco.Web/umbraco.presentation/umbraco/dialogs/create.aspx.designer.cs
+++ /dev/null
@@ -1,79 +0,0 @@
-//------------------------------------------------------------------------------
-// <auto-generated>
-//     This code was generated by a tool.
-//     Runtime Version:2.0.50727.4200
-//
-//     Changes to this file may cause incorrect behavior and will be lost if
-//     the code is regenerated.
-// </auto-generated>
-//------------------------------------------------------------------------------
-
-namespace umbraco.dialogs {
-    
-    
-    public partial class create {
-        
-        /// <summary>
-        /// path control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.HtmlControls.HtmlInputHidden path;
-        
-        /// <summary>
-        /// pane_chooseNode control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Pane pane_chooseNode;
-        
-        /// <summary>
-        /// JTree control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.controls.Tree.TreeControl JTree;
-        
-        /// <summary>
-        /// panel_buttons control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.Panel panel_buttons;
-        
-        /// <summary>
-        /// PageNameHolder control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Feedback PageNameHolder;
-        
-        /// <summary>
-        /// pane_chooseName control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::umbraco.uicontrols.Pane pane_chooseName;
-        
-        /// <summary>
-        /// phCreate control.
-        /// </summary>
-        /// <remarks>
-        /// Auto-generated field.
-        /// To modify move field declaration from designer file to code-behind file.
-        /// </remarks>
-        protected global::System.Web.UI.WebControls.PlaceHolder phCreate;
-    }
-}