From c971a2d23dd9edb2c9f42d373f6e1a3d4ce2f00f Mon Sep 17 00:00:00 2001 From: Andy Butland Date: Wed, 18 Nov 2020 17:37:31 +0100 Subject: [PATCH] Introduced website security accessor to ensure members aren't shared between sessions. --- .../HybridBackofficeSecurityAccessor.cs | 9 ++---- .../HybridUmbracoWebsiteSecurityAccessor.cs | 28 +++++++++++++++++++ .../IUmbracoWebsiteSecurityAccessor.cs | 7 +++++ .../Runtime/AspNetCoreComposer.cs | 3 ++ .../Controllers/UmbLoginController.cs | 8 +++--- .../Controllers/UmbLoginStatusController.cs | 10 +++---- .../Controllers/UmbProfileController.cs | 8 +++--- .../Controllers/UmbRegisterController.cs | 8 +++--- ...racoWebstiteServiceCollectionExtensions.cs | 3 -- 9 files changed, 58 insertions(+), 26 deletions(-) rename src/Umbraco.Core/{ => Security}/HybridBackofficeSecurityAccessor.cs (72%) create mode 100644 src/Umbraco.Core/Security/HybridUmbracoWebsiteSecurityAccessor.cs create mode 100644 src/Umbraco.Core/Security/IUmbracoWebsiteSecurityAccessor.cs diff --git a/src/Umbraco.Core/HybridBackofficeSecurityAccessor.cs b/src/Umbraco.Core/Security/HybridBackofficeSecurityAccessor.cs similarity index 72% rename from src/Umbraco.Core/HybridBackofficeSecurityAccessor.cs rename to src/Umbraco.Core/Security/HybridBackofficeSecurityAccessor.cs index 4549227c89..eb4be355f4 100644 --- a/src/Umbraco.Core/HybridBackofficeSecurityAccessor.cs +++ b/src/Umbraco.Core/Security/HybridBackofficeSecurityAccessor.cs @@ -1,15 +1,12 @@ using Umbraco.Core.Cache; -using Umbraco.Core.Security; using Umbraco.Web; -using Umbraco.Web.Security; -namespace Umbraco.Core +namespace Umbraco.Core.Security { - public class HybridBackofficeSecurityAccessor : HybridAccessorBase, IBackOfficeSecurityAccessor { /// - /// Initializes a new instance of the class. + /// Initializes a new instance of the class. /// public HybridBackofficeSecurityAccessor(IRequestCache requestCache) : base(requestCache) @@ -19,7 +16,7 @@ namespace Umbraco.Core protected override string ItemKey => "Umbraco.Web.HybridBackofficeSecurityAccessor"; /// - /// Gets or sets the object. + /// Gets or sets the object. /// public IBackOfficeSecurity BackOfficeSecurity { diff --git a/src/Umbraco.Core/Security/HybridUmbracoWebsiteSecurityAccessor.cs b/src/Umbraco.Core/Security/HybridUmbracoWebsiteSecurityAccessor.cs new file mode 100644 index 0000000000..09a7ab5d1b --- /dev/null +++ b/src/Umbraco.Core/Security/HybridUmbracoWebsiteSecurityAccessor.cs @@ -0,0 +1,28 @@ +using Umbraco.Core.Cache; +using Umbraco.Web; + +namespace Umbraco.Core.Security +{ + + public class HybridUmbracoWebsiteSecurityAccessor : HybridAccessorBase, IUmbracoWebsiteSecurityAccessor + { + /// + /// Initializes a new instance of the class. + /// + public HybridUmbracoWebsiteSecurityAccessor(IRequestCache requestCache) + : base(requestCache) + { } + + /// + protected override string ItemKey => "Umbraco.Web.HybridUmbracoWebsiteSecurityAccessor"; + + /// + /// Gets or sets the object. + /// + public IUmbracoWebsiteSecurity WebsiteSecurity + { + get => Value; + set => Value = value; + } + } +} diff --git a/src/Umbraco.Core/Security/IUmbracoWebsiteSecurityAccessor.cs b/src/Umbraco.Core/Security/IUmbracoWebsiteSecurityAccessor.cs new file mode 100644 index 0000000000..618aeb7146 --- /dev/null +++ b/src/Umbraco.Core/Security/IUmbracoWebsiteSecurityAccessor.cs @@ -0,0 +1,7 @@ +namespace Umbraco.Core.Security +{ + public interface IUmbracoWebsiteSecurityAccessor + { + IUmbracoWebsiteSecurity WebsiteSecurity { get; set; } + } +} diff --git a/src/Umbraco.Web.Common/Runtime/AspNetCoreComposer.cs b/src/Umbraco.Web.Common/Runtime/AspNetCoreComposer.cs index 8acea23289..82fc2701a1 100644 --- a/src/Umbraco.Web.Common/Runtime/AspNetCoreComposer.cs +++ b/src/Umbraco.Web.Common/Runtime/AspNetCoreComposer.cs @@ -74,9 +74,12 @@ namespace Umbraco.Web.Common.Runtime // register the umbraco context factory composition.Services.AddUnique(); + composition.Services.AddUnique(); composition.Services.AddUnique(); + composition.Services.AddUnique(); + //register the install components composition.ComposeInstaller(); diff --git a/src/Umbraco.Web.Website/Controllers/UmbLoginController.cs b/src/Umbraco.Web.Website/Controllers/UmbLoginController.cs index 51938f00f5..6ba0f582c8 100644 --- a/src/Umbraco.Web.Website/Controllers/UmbLoginController.cs +++ b/src/Umbraco.Web.Website/Controllers/UmbLoginController.cs @@ -14,14 +14,14 @@ namespace Umbraco.Web.Website.Controllers { public class UmbLoginController : SurfaceController { - private readonly IUmbracoWebsiteSecurity _websiteSecurity; + private readonly IUmbracoWebsiteSecurityAccessor _websiteSecurityAccessor; public UmbLoginController(IUmbracoContextAccessor umbracoContextAccessor, IUmbracoDatabaseFactory databaseFactory, ServiceContext services, AppCaches appCaches, IProfilingLogger profilingLogger, IPublishedUrlProvider publishedUrlProvider, - IUmbracoWebsiteSecurity websiteSecurity) + IUmbracoWebsiteSecurityAccessor websiteSecurityAccessor) : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider) { - _websiteSecurity = websiteSecurity; + _websiteSecurityAccessor = websiteSecurityAccessor; } [HttpPost] @@ -34,7 +34,7 @@ namespace Umbraco.Web.Website.Controllers return CurrentUmbracoPage(); } - if (await _websiteSecurity.LoginAsync(model.Username, model.Password) == false) + if (await _websiteSecurityAccessor.WebsiteSecurity.LoginAsync(model.Username, model.Password) == false) { // Don't add a field level error, just model level. ModelState.AddModelError("loginModel", "Invalid username or password"); diff --git a/src/Umbraco.Web.Website/Controllers/UmbLoginStatusController.cs b/src/Umbraco.Web.Website/Controllers/UmbLoginStatusController.cs index 3da1f34282..e9bf164eb3 100644 --- a/src/Umbraco.Web.Website/Controllers/UmbLoginStatusController.cs +++ b/src/Umbraco.Web.Website/Controllers/UmbLoginStatusController.cs @@ -15,14 +15,14 @@ namespace Umbraco.Web.Website.Controllers [UmbracoMemberAuthorize] public class UmbLoginStatusController : SurfaceController { - private readonly IUmbracoWebsiteSecurity _websiteSecurity; + private readonly IUmbracoWebsiteSecurityAccessor _websiteSecurityAccessor; public UmbLoginStatusController(IUmbracoContextAccessor umbracoContextAccessor, IUmbracoDatabaseFactory databaseFactory, ServiceContext services, AppCaches appCaches, - IProfilingLogger profilingLogger, IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurity websiteSecurity) + IProfilingLogger profilingLogger, IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurityAccessor websiteSecurityAccessor) : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider) { - _websiteSecurity = websiteSecurity; + _websiteSecurityAccessor = websiteSecurityAccessor; } [HttpPost] @@ -35,9 +35,9 @@ namespace Umbraco.Web.Website.Controllers return CurrentUmbracoPage(); } - if (_websiteSecurity.IsLoggedIn()) + if (_websiteSecurityAccessor.WebsiteSecurity.IsLoggedIn()) { - await _websiteSecurity.LogOutAsync(); + await _websiteSecurityAccessor.WebsiteSecurity.LogOutAsync(); } TempData["LogoutSuccess"] = true; diff --git a/src/Umbraco.Web.Website/Controllers/UmbProfileController.cs b/src/Umbraco.Web.Website/Controllers/UmbProfileController.cs index 69bf77981e..cc23786c4b 100644 --- a/src/Umbraco.Web.Website/Controllers/UmbProfileController.cs +++ b/src/Umbraco.Web.Website/Controllers/UmbProfileController.cs @@ -16,14 +16,14 @@ namespace Umbraco.Web.Website.Controllers [UmbracoMemberAuthorize] public class UmbProfileController : SurfaceController { - private readonly IUmbracoWebsiteSecurity _websiteSecurity; + private readonly IUmbracoWebsiteSecurityAccessor _websiteSecurityAccessor; public UmbProfileController(IUmbracoContextAccessor umbracoContextAccessor, IUmbracoDatabaseFactory databaseFactory, ServiceContext services, AppCaches appCaches, IProfilingLogger profilingLogger, - IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurity websiteSecurity) + IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurityAccessor websiteSecurityAccessor) : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider) { - _websiteSecurity = websiteSecurity; + _websiteSecurityAccessor = websiteSecurityAccessor; } [HttpPost] @@ -36,7 +36,7 @@ namespace Umbraco.Web.Website.Controllers return CurrentUmbracoPage(); } - var result = await _websiteSecurity.UpdateMemberProfileAsync(model); + var result = await _websiteSecurityAccessor.WebsiteSecurity.UpdateMemberProfileAsync(model); switch (result.Status) { case UpdateMemberProfileStatus.Success: diff --git a/src/Umbraco.Web.Website/Controllers/UmbRegisterController.cs b/src/Umbraco.Web.Website/Controllers/UmbRegisterController.cs index 8af2157022..9542a2bf75 100644 --- a/src/Umbraco.Web.Website/Controllers/UmbRegisterController.cs +++ b/src/Umbraco.Web.Website/Controllers/UmbRegisterController.cs @@ -15,14 +15,14 @@ namespace Umbraco.Web.Website.Controllers { public class UmbRegisterController : SurfaceController { - private readonly IUmbracoWebsiteSecurity _websiteSecurity; + private readonly IUmbracoWebsiteSecurityAccessor _websiteSecurityAccessor; public UmbRegisterController(IUmbracoContextAccessor umbracoContextAccessor, IUmbracoDatabaseFactory databaseFactory, ServiceContext services, AppCaches appCaches, - IProfilingLogger profilingLogger, IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurity websiteSecurity) + IProfilingLogger profilingLogger, IPublishedUrlProvider publishedUrlProvider, IUmbracoWebsiteSecurityAccessor websiteSecurityAccessor) : base(umbracoContextAccessor, databaseFactory, services, appCaches, profilingLogger, publishedUrlProvider) { - _websiteSecurity = websiteSecurity; + _websiteSecurityAccessor = websiteSecurityAccessor; } [HttpPost] @@ -42,7 +42,7 @@ namespace Umbraco.Web.Website.Controllers model.Name = model.Email; } - var result = await _websiteSecurity.RegisterMemberAsync(model, model.LoginOnSuccess); + var result = await _websiteSecurityAccessor.WebsiteSecurity.RegisterMemberAsync(model, model.LoginOnSuccess); switch (result) { diff --git a/src/Umbraco.Web.Website/Extensions/UmbracoWebstiteServiceCollectionExtensions.cs b/src/Umbraco.Web.Website/Extensions/UmbracoWebstiteServiceCollectionExtensions.cs index 12efe81138..5737cb1030 100644 --- a/src/Umbraco.Web.Website/Extensions/UmbracoWebstiteServiceCollectionExtensions.cs +++ b/src/Umbraco.Web.Website/Extensions/UmbracoWebstiteServiceCollectionExtensions.cs @@ -23,9 +23,6 @@ namespace Umbraco.Extensions //TODO figure out if we need more to work on load balanced setups services.AddDataProtection(); - - // Website security - services.AddSingleton(); } } }