yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removes umbraco settings: ImageTagAllowedAttributes, UploadAllowDirectories, ensureUniqueNaming, ImageTagAllowedAttributes, ScriptEditorDisable, ScriptFolderPath, UploadAllowDirectories

Browse Source
This commit is contained in:
Shannon
2019-01-30 23:42:25 +11:00
parent a331632800
commit fccfa4f412
27 changed files with 175 additions and 298 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Umbraco.Web.UI/config/umbracoSettings.Release.config
View File

@@ -18,14 +18,14 @@
<error404>1</error404>
<!--
The value for error pages can be:
* A content item's integer ID (example: 1234)
* A content item's GUID ID (example: 26C1D84F-C900-4D53-B167-E25CC489DAC8)
* An XPath statement (example: //errorPages[@nodeName='My cool error']
* A content item's integer ID (example: 1234)
-->
<!--
<error404>
<errorPage culture="default">1</errorPage>
<errorPage culture="en-US">200</errorPage>
<errorPage culture="default">26C1D84F-C900-4D53-B167-E25CC489DAC8</errorPage>
<errorPage culture="en-US">D820E120-6865-4D88-BFFE-48801A6AC375</errorPage>
</error404>
-->
</errors>

279
src/Umbraco.Web.UI/config/umbracoSettings.config
View File

@@ -5,189 +5,174 @@
<tours enable="true"></tours>
</backOffice>
<content>
<imaging>
<!-- what file extension that should cause umbraco to create thumbnails -->
<imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif,svg</imageFileTypes>
<!-- what attributes that are allowed in the editor on an img tag -->
<allowedAttributes>src,alt,border,class,style,align,id,name,onclick,usemap</allowedAttributes>
<!-- automatically updates dimension, filesize and extension attributes on upload -->
<autoFillImageProperties>
<uploadField alias="umbracoFile">
<widthFieldAlias>umbracoWidth</widthFieldAlias>
<heightFieldAlias>umbracoHeight</heightFieldAlias>
<lengthFieldAlias>umbracoBytes</lengthFieldAlias>
<extensionFieldAlias>umbracoExtension</extensionFieldAlias>
</uploadField>
</autoFillImageProperties>
<content>
<imaging>
<!-- what file extension should umbraco determine are images for uploaded files -->
<imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif,svg</imageFileTypes>
<!-- defines the property that contains an image with a URL and the properties to update with it's dimensions -->
<autoFillImageProperties>
<uploadField alias="umbracoFile">
<widthFieldAlias>umbracoWidth</widthFieldAlias>
<heightFieldAlias>umbracoHeight</heightFieldAlias>
<lengthFieldAlias>umbracoBytes</lengthFieldAlias>
<extensionFieldAlias>umbracoExtension</extensionFieldAlias>
</uploadField>
</autoFillImageProperties>
</imaging>
<scripteditor>
<!-- Path to script folder - no ending "/" -->
<scriptFolderPath>/scripts</scriptFolderPath>
<!-- what files can be opened/created in the script editor -->
<scriptFileTypes>js,xml</scriptFileTypes>
<!-- disable the codemirror editor and use a simple textarea instead -->
<scriptDisableEditor>false</scriptDisableEditor>
</scripteditor>
</imaging>
<!-- should umbraco store the uploaded files like /media/xxx/filename.ext or like /media/xxx-filename.ext
should be set to false if the application pool's user account hasn't got readrights of the driveroot up to the /media directory -->
<UploadAllowDirectories>True</UploadAllowDirectories>
<errors>
<!-- the id of the page that should be shown if the page is not found -->
<!--<error404>
<errors>
<!-- the id of the page that should be shown if the page is not found -->
<!--<error404>
<errorPage culture="default">1</errorPage>
<errorPage culture="en-US">200</errorPage>
</error404>-->
<error404>
<errorPage culture="default">1</errorPage>
<errorPage culture="fr-FR">1079</errorPage>
<errorPage culture="en-US">1080</errorPage>
</error404>
</errors>
<notifications>
<!-- the email that should be used as from mail when umbraco sends a notification -->
<!-- you can add a display name to the email like this: <email>Your display name here &lt;your@email.here&gt;</email> -->
<email>your@email.here</email>
</notifications>
<error404>
<errorPage culture="default">1</errorPage>
<errorPage culture="fr-FR">1079</errorPage>
<errorPage culture="en-US">1080</errorPage>
</error404>
</errors>
<notifications>
<!-- the email that should be used as from mail when umbraco sends a notification -->
<!-- you can add a display name to the email like this: <email>Your display name here &lt;your@email.here&gt;</email> -->
<email>your@email.here</email>
</notifications>
<!-- if true umbraco will ensure that no page under the same parent has an identical name -->
<ensureUniqueNaming>True</ensureUniqueNaming>
<!-- Whether to force safe aliases (no spaces, no special characters) at businesslogic level on contenttypes and propertytypes -->
<!-- HIGHLY recommend to keep this to true to ensure valid and beautiful XML Schemas -->
<ForceSafeAliases>true</ForceSafeAliases>
<!-- Whether to force safe aliases (no spaces, no special characters) at businesslogic level on contenttypes and propertytypes -->
<!-- HIGHLY recommend to keep this to true to ensure valid and beautiful XML Schemas -->
<ForceSafeAliases>true</ForceSafeAliases>
<!-- Enable / disable xml content cache -->
<XmlCacheEnabled>True</XmlCacheEnabled>
<!-- Enable / disable xml content cache -->
<XmlCacheEnabled>True</XmlCacheEnabled>
<!-- Update disk cache every time content has changed -->
<ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>
<!-- Update disk cache every time content has changed -->
<ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>
<!-- Update in-memory cache if xml file is changed -->
<XmlContentCheckForDiskChanges>False</XmlContentCheckForDiskChanges>
<!-- Update in-memory cache if xml file is changed -->
<XmlContentCheckForDiskChanges>False</XmlContentCheckForDiskChanges>
<!-- Show property descriptions in editing view "icon|text|none" -->
<PropertyContextHelpOption>text</PropertyContextHelpOption>
<!-- Show property descriptions in editing view "icon|text|none" -->
<PropertyContextHelpOption>text</PropertyContextHelpOption>
<!-- The html injected into a (x)html page if Umbraco is running in preview mode -->
<PreviewBadge>
<![CDATA[
<!-- The html injected into a (x)html page if Umbraco is running in preview mode -->
<PreviewBadge>
<![CDATA[
<a id="umbracoPreviewBadge" style="z-index:99999; position: absolute; top: 0; right: 0; border: 0; width: 149px; height: 149px; background: url('{0}/assets/img/preview-mode-badge.png') no-repeat;" href="#" OnClick="javascript:window.top.location.href = '{0}/preview/end?redir={1}'"><span style="display:none;">In Preview Mode - click to end</span></a>
]]></PreviewBadge>
]]>
</PreviewBadge>
<!-- Url Resolving ensures that all links works if you run Umbraco in virtual directories -->
<!-- Setting this to true can increase render time for pages with a large number of links -->
<!-- If running Umbraco in virtual directory this *must* be set to true! -->
<ResolveUrlsFromTextString>false</ResolveUrlsFromTextString>
<!-- Url Resolving ensures that all links works if you run Umbraco in virtual directories -->
<!-- Setting this to true can increase render time for pages with a large number of links -->
<!-- If running Umbraco in virtual directory this *must* be set to true! -->
<ResolveUrlsFromTextString>false</ResolveUrlsFromTextString>
<!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
<!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
- inline - show an inline error within the macro but allow the page to continue rendering. Historial Umbraco behaviour.
- silent - Silently suppress the error and do not render the offending macro.
- throw - Throw an exception which can be caught by the global error handler defined in Application_OnError. If no such
error handler is defined then you'll see the Yellow Screen Of Death (YSOD) error page.
Note the error can also be handled by the umbraco.macro.Error event, where you can log/alarm with your own code and change the behaviour per event. -->
<MacroErrors>throw</MacroErrors>
<MacroErrors>throw</MacroErrors>
<!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
<disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,xhtml,html,htm,php,htaccess</disallowedUploadFiles>
<!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
<disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,xhtml,html,htm,php,htaccess</disallowedUploadFiles>
<!-- If completed, only the file extensions listed below will be allowed to be uploaded. If empty, disallowedUploadFiles will apply to prevent upload of specific file extensions. -->
<allowedUploadFiles></allowedUploadFiles>
<!-- If completed, only the file extensions listed below will be allowed to be uploaded. If empty, disallowedUploadFiles will apply to prevent upload of specific file extensions. -->
<allowedUploadFiles></allowedUploadFiles>
<!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
<defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>
<!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
<defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>
<showDeprecatedPropertyEditors>false</showDeprecatedPropertyEditors>
<showDeprecatedPropertyEditors>false</showDeprecatedPropertyEditors>
<!-- Enables value converters for all built in property editors so that they return strongly typed object, recommended for use with Models Builder -->
<!--
<!-- Enables value converters for all built in property editors so that they return strongly typed object, recommended for use with Models Builder -->
<!--
<EnablePropertyValueConverters>true</EnablePropertyValueConverters>
-->
<!-- You can specify your own background image for the login screen here. The image will automatically get an overlay to match back office colors - this path is relative to the ~/umbraco path. The default location is: /umbraco/assets/img/installer.jpg -->
<loginBackgroundImage>assets/img/installer.jpg</loginBackgroundImage>
<!-- You can specify your own background image for the login screen here. The image will automatically get an overlay to match back office colors - this path is relative to the ~/umbraco path. The default location is: /umbraco/assets/img/installer.jpg -->
<loginBackgroundImage>assets/img/installer.jpg</loginBackgroundImage>
</content>
</content>
<security>
<!-- set to true to auto update login interval (and there by disabling the lock screen -->
<keepUserLoggedIn>true</keepUserLoggedIn>
<security>
<!-- set to true to auto update login interval (and there by disabling the lock screen -->
<keepUserLoggedIn>true</keepUserLoggedIn>
<!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
<hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
<!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
<hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
<!-- set to true to enable the UI and API to allow back-office users to reset their passwords -->
<allowPasswordReset>true</allowPasswordReset>
<!-- set to true to enable the UI and API to allow back-office users to reset their passwords -->
<allowPasswordReset>true</allowPasswordReset>
</security>
</security>
<requestHandler>
<!-- this will ensure that urls are unique when running with multiple root nodes -->
<useDomainPrefixes>false</useDomainPrefixes>
<!-- this will add a trailing slash (/) to urls when in directory url mode -->
<addTrailingSlash>true</addTrailingSlash>
<urlReplacing removeDoubleDashes="true" toAscii="try">
<char org=" ">-</char>
<char org="&quot;"></char>
<char org="'"></char>
<char org="%"></char>
<char org="."></char>
<char org=";"></char>
<char org="/"></char>
<char org="\"></char>
<char org=":"></char>
<char org="#"></char>
<char org="+">plus</char>
<char org="*">star</char>
<char org="&amp;"></char>
<char org="?"></char>
<char org="æ">ae</char>
<char org="ø">oe</char>
<char org="Ã¥">aa</char>
<char org="ä">ae</char>
<char org="ö">oe</char>
<char org="ü">ue</char>
<char org="ß">ss</char>
<char org="Ä">ae</char>
<char org="Ö">oe</char>
<char org="|">-</char>
<char org="&lt;"></char>
<char org="&gt;"></char>
</urlReplacing>
</requestHandler>
<requestHandler>
<!-- this will ensure that urls are unique when running with multiple root nodes -->
<useDomainPrefixes>false</useDomainPrefixes>
<!-- this will add a trailing slash (/) to urls when in directory url mode -->
<addTrailingSlash>true</addTrailingSlash>
<urlReplacing removeDoubleDashes="true" toAscii="try">
<char org=" ">-</char>
<char org="&quot;"></char>
<char org="'"></char>
<char org="%"></char>
<char org="."></char>
<char org=";"></char>
<char org="/"></char>
<char org="\"></char>
<char org=":"></char>
<char org="#"></char>
<char org="+">plus</char>
<char org="*">star</char>
<char org="&amp;"></char>
<char org="?"></char>
<char org="æ">ae</char>
<char org="ø">oe</char>
<char org="Ã¥">aa</char>
<char org="ä">ae</char>
<char org="ö">oe</char>
<char org="ü">ue</char>
<char org="ß">ss</char>
<char org="Ä">ae</char>
<char org="Ö">oe</char>
<char org="|">-</char>
<char org="&lt;"></char>
<char org="&gt;"></char>
</urlReplacing>
</requestHandler>
<!--
<!--
Now that we have external logging enabled, this section is only used for what gets logged to the umbracoLog table
which currently logs items used in the audit trail and roll back scenarios.
-->
<logging>
<enableLogging>true</enableLogging>
<enableAsyncLogging>true</enableAsyncLogging>
<disabledLogTypes>
<!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
</disabledLogTypes>
<!-- You can add your own logging tool by implementing the umbraco.BusinessLogic.Interfaces.ILog interface and add the reference here -->
<!-- The external logger can also act as the audit trail storage by setting the logAuditTrail attribute to true -->
<!--<externalLogger assembly="~/bin/assemblyFileName.dll" type="fully.qualified.namespace.and.type" logAuditTrail="false" /> -->
</logging>
<logging>
<enableLogging>true</enableLogging>
<enableAsyncLogging>true</enableAsyncLogging>
<disabledLogTypes>
<!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
</disabledLogTypes>
<!-- You can add your own logging tool by implementing the umbraco.BusinessLogic.Interfaces.ILog interface and add the reference here -->
<!-- The external logger can also act as the audit trail storage by setting the logAuditTrail attribute to true -->
<!--<externalLogger assembly="~/bin/assemblyFileName.dll" type="fully.qualified.namespace.and.type" logAuditTrail="false" /> -->
</logging>
<scheduledTasks>
<!-- add tasks that should be called with an interval (seconds) -->
<!-- <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
</scheduledTasks>
<scheduledTasks>
<!-- add tasks that should be called with an interval (seconds) -->
<!-- <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
</scheduledTasks>
<providers>
<users>
<!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
<!-- specify it here (remember to add it to the web.config as well) -->
<DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
</users>
</providers>
<providers>
<users>
<!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
<!-- specify it here (remember to add it to the web.config as well) -->
<DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
</users>
</providers>
<!--
<!--
web.routing
@trySkipIisCustomErrors
Tries to skip IIS custom errors.
@@ -220,10 +205,10 @@
Configure it here if you need anything specific. Needs to be a complete url with scheme and umbraco
path, eg http://mysite.com/umbraco. NOT just "mysite.com" or "mysite.com/umbraco" or "http://mysite.com".
-->
<web.routing
trySkipIisCustomErrors="false"
internalRedirectPreservesTemplate="false" disableAlternativeTemplates="false" validateAlternativeTemplates="false" disableFindContentByIdPath="false"
umbracoApplicationUrl="">
</web.routing>
<web.routing
trySkipIisCustomErrors="false"
internalRedirectPreservesTemplate="false" disableAlternativeTemplates="false" validateAlternativeTemplates="false" disableFindContentByIdPath="false"
umbracoApplicationUrl="">
</web.routing>
</settings>