From 1a0284164936ab4984f9c52fd3ba8c9b25e81959 Mon Sep 17 00:00:00 2001
From: Shannon <sdeminick@gmail.com>
Date: Tue, 28 Jun 2016 16:01:23 +0200
Subject: [PATCH 1/2] U4-8472 Add web.config file to media folder path to
 prevent all execution based files from being run by IIS

---
 src/Umbraco.Web.UI/Media/Web.config      | 9 +++++++++
 src/Umbraco.Web.UI/Umbraco.Web.UI.csproj | 6 +++---
 2 files changed, 12 insertions(+), 3 deletions(-)
 create mode 100644 src/Umbraco.Web.UI/Media/Web.config

diff --git a/src/Umbraco.Web.UI/Media/Web.config b/src/Umbraco.Web.UI/Media/Web.config
new file mode 100644
index 0000000000..6cbb733ea7
--- /dev/null
+++ b/src/Umbraco.Web.UI/Media/Web.config
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <system.webServer>
+    <handlers>
+      <clear />
+      <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
+    </handlers>
+  </system.webServer>
+</configuration> 
\ No newline at end of file
diff --git a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
index 6911829bb8..0243fbbf0c 100644
--- a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
+++ b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
@@ -695,6 +695,7 @@
       <SubType>Designer</SubType>
     </None>
     <Content Include="Umbraco\Install\Views\Index.cshtml" />
+    <Content Include="Media\Web.config" />
     <None Include="packages.config">
       <SubType>Designer</SubType>
     </None>
@@ -2383,7 +2384,6 @@
   </ItemGroup>
   <ItemGroup>
     <Folder Include="App_Data\" />
-    <Folder Include="Media\" />
     <Folder Include="Umbraco\preview\" />
     <Folder Include="Umbraco_Client\FolderBrowser\Images\" />
     <Folder Include="Umbraco_Client\Tags\images\" />
@@ -2441,8 +2441,8 @@ xcopy "$(ProjectDir)"..\packages\SqlServerCE.4.0.0.1\x86\*.* "$(TargetDir)x86\"
     <!-- Always transform the Template file when not in VS (ie: build.bat) -->
     <TransformXml Source="$(ProjectDir)Web.Template.config" Transform="$(ProjectDir)web.Template.$(Configuration).config" Destination="Web.$(Configuration).config.transformed" Condition="$(BuildingInsideVisualStudio) != true" />
     <!-- Create ClientDependency.config file from Template if it doesn't exist -->
-    <Copy SourceFiles="$(ProjectDir)Config\ClientDependency.Release.config" DestinationFiles="$(ProjectDir)Config\ClientDependency.config" OverwriteReadOnlyFiles="true" SkipUnchangedFiles="false" Condition="!Exists('$(ProjectDir)Config\ClientDependency.config')" />    
-	<!-- Only runs if the Belle build folder doesn't yet exist -->
+    <Copy SourceFiles="$(ProjectDir)Config\ClientDependency.Release.config" DestinationFiles="$(ProjectDir)Config\ClientDependency.config" OverwriteReadOnlyFiles="true" SkipUnchangedFiles="false" Condition="!Exists('$(ProjectDir)Config\ClientDependency.config')" />
+    <!-- Only runs if the Belle build folder doesn't yet exist -->
     <CallTarget Targets="BelleBuild" Condition="!Exists('$(ProjectDir)\..\Umbraco.Web.UI.Client\build')" />
   </Target>
   <Target Name="AfterBuild">

From 0f19937aec3ebbaf4193b322d4934687d69e8b34 Mon Sep 17 00:00:00 2001
From: Sebastiaan Janssen <sebastiaan@umbraco.com>
Date: Wed, 6 Jul 2016 12:31:44 +0200
Subject: [PATCH 2/2] Making sure the media/web.config is correctly installed
 from nuget

---
 build/NuSpecs/UmbracoCms.nuspec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build/NuSpecs/UmbracoCms.nuspec b/build/NuSpecs/UmbracoCms.nuspec
index 66e82ac488..5ee38e57fe 100644
--- a/build/NuSpecs/UmbracoCms.nuspec
+++ b/build/NuSpecs/UmbracoCms.nuspec
@@ -32,6 +32,7 @@
     <file src="..\_BuildOutput\WebApp\config\splashes\**" target="UmbracoFiles\Config\splashes" />
     <file src="..\_BuildOutput\WebApp\umbraco\**" target="UmbracoFiles\umbraco" />
     <file src="..\_BuildOutput\WebApp\umbraco_client\**" target="UmbracoFiles\umbraco_client" />
+    <file src="..\_BuildOutput\WebApp\Media\Web.config" target="Content\Media\Web.config" />
     <file src="tools\install.ps1" target="tools\install.ps1" />
     <file src="tools\Readme.txt" target="tools\Readme.txt" />
     <file src="tools\ReadmeUpgrade.txt" target="tools\ReadmeUpgrade.txt" />