yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Updated nuget packages and take a explicit dependency on Microsoft.IdentityModel.JsonWebTokens (#16935)

Browse Source
This commit is contained in:
Bjarke Berg
2024-08-21 10:25:39 +02:00
committed by GitHub
parent f99f821a6d
commit 79080ffa93
7 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/Umbraco.Cms.Api.Common/Umbraco.Cms.Api.Common.csproj
View File

@@ -12,6 +12,9 @@
<PackageReference Include="Swashbuckle.AspNetCore" />
<PackageReference Include="OpenIddict.Abstractions" />
<PackageReference Include="OpenIddict.AspNetCore" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup>
<ItemGroup>

3
src/Umbraco.Cms.Persistence.EFCore.SqlServer/Umbraco.Cms.Persistence.EFCore.SqlServer.csproj
View File

@@ -8,6 +8,9 @@
<!-- Take top-level depedendency on Azure.Identity, because Microsoft.EntityFrameworkCore.SqlServer depends on a vulnerable version -->
<PackageReference Include="Azure.Identity" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup>
<ItemGroup>

3
src/Umbraco.Cms.Persistence.SqlServer/Umbraco.Cms.Persistence.SqlServer.csproj
View File

@@ -8,6 +8,9 @@
<!-- Take top-level depedendency on Azure.Identity, because NPoco.SqlServer depends on a vulnerable version -->
<PackageReference Include="Azure.Identity" />
<PackageReference Include="NPoco.SqlServer" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup>
<ItemGroup>

2
src/Umbraco.Web.BackOffice/Controllers/AuthenticationController.cs
View File

@@ -708,6 +708,8 @@ public class AuthenticationController : UmbracoApiControllerBase
return Ok();
}
await _signInManager.SignOutAsync();
_logger.LogInformation("User {UserName} from IP address {RemoteIpAddress} has logged out",

2
src/Umbraco.Web.Common/Umbraco.Web.Common.csproj
View File

@@ -24,6 +24,8 @@
<PackageReference Include="System.Net.Http" />
<!-- Take top-level depedendency on System.Text.RegularExpressions, because both Dazinator.Extensions.FileProviders and MiniProfiler.AspNetCore.Mvc depend on a vulnerable version -->
<PackageReference Include="System.Text.RegularExpressions" />
<!-- Both OpenIddict.AspNetCore, Npoco.SqlServer and Microsoft.EntityFrameworkCore.SqlServer bring in a vulnerable version of Microsoft.IdentityModel.JsonWebTokens -->
<PackageReference Include="Microsoft.IdentityModel.JsonWebTokens"/>
</ItemGroup>
<ItemGroup>