swcs/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

removes old helpers/url

Browse Source
This commit is contained in:
Shannon
2015-12-22 16:43:11 +01:00
parent 24e2341115
commit 1aa52b4cc9
10 changed files with 84 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Umbraco.Web.UI/config/splashes/booting.aspx
+6 -3
View File
@@ -1,11 +1,14 @@
<%@ Page Language="C#" AutoEventWireup="true" Inherits="System.Web.UI.Page" %>
<%@ Import Namespace="System.Web.Mvc" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%
var urlHelper = new UrlHelper(Request.RequestContext);
// NH: Adds this inline check to avoid a simple codebehind file in the legacy project!
if (Request["url"].ToLower().Contains("booting.aspx") || !umbraco.cms.helpers.url.ValidateProxyUrl(Request["url"], Request.Url.AbsoluteUri))
if (Request["url"].ToLower().Contains("booting.aspx") || urlHelper.ValidateProxyUrl(Request["url"], Request.Url.AbsoluteUri) == false)
{
throw new ArgumentException("Can't redirect to the requested url - it's not local or an approved proxy url",
"url");
throw new ArgumentException("Can't redirect to the requested url - it's not local or an approved proxy url", "url");
}
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
src/Umbraco.Web.UI/umbraco/dialogs/publish.aspx
+1
View File
@@ -2,6 +2,7 @@
<%@ Import Namespace="Umbraco.Core" %>
<%@ Import Namespace="Umbraco.Web" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
<%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
src/Umbraco.Web.UI/umbraco/settings/editTemplate.aspx
+1
View File
@@ -6,6 +6,7 @@
<%@ Import Namespace="Umbraco.Core" %>
<%@ Import Namespace="Umbraco.Core.Configuration" %>
<%@ Import Namespace="Umbraco.Core.IO" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
<%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
src/Umbraco.Web.UI/umbraco/settings/scripts/editScript.aspx
+1
View File
@@ -2,6 +2,7 @@
CodeBehind="editScript.aspx.cs" Inherits="umbraco.cms.presentation.settings.scripts.editScript"
ValidateRequest="False" %>
<%@ Import Namespace="Umbraco.Core" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
<%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
src/Umbraco.Web.UI/umbraco/settings/stylesheet/editstylesheet.aspx
+1
View File
@@ -1,6 +1,7 @@
<%@ Page Language="c#" MasterPageFile="../../masterpages/umbracoPage.Master" CodeBehind="editstylesheet.aspx.cs" AutoEventWireup="True"
Inherits="Umbraco.Web.UI.Umbraco.Settings.Stylesheet.EditStyleSheet" ValidateRequest="False" %>
<%@ Import Namespace="Umbraco.Core" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
<%@ Register TagPrefix="cdf" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
src/Umbraco.Web.UI/umbraco/settings/views/EditView.aspx
+1
View File
@@ -7,6 +7,7 @@
<%@ Import Namespace="Umbraco.Core" %>
<%@ Import Namespace="Umbraco.Core.IO" %>
<%@ Import Namespace="Umbraco.Web" %>
<%@ Import Namespace="Umbraco.Web.Mvc" %>
<%@ Register TagPrefix="cc1" Namespace="umbraco.uicontrols" Assembly="controls" %>
<%@ Register TagPrefix="umb" Namespace="ClientDependency.Core.Controls" Assembly="ClientDependency.Core" %>
src/Umbraco.Web/Mvc/UrlHelperExtensions.cs
+72 -10
View File
@@ -1,24 +1,86 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Web.Mvc;
using Umbraco.Core;
using Umbraco.Core.Configuration;
using Umbraco.Core.IO;
namespace Umbraco.Core
namespace Umbraco.Web.Mvc
{
/// <summary>
/// Extension methods for UrlHelper
/// </summary>
public static class UrlHelperExtensions
{
/// <summary>
/// Utility method for checking for valid proxy urls or redirect urls to prevent Open Redirect security issues
/// </summary>
/// <param name="urlHelper"></param>
/// <param name="url">The url to validate</param>
/// <param name="callerUrl">The url of the current local domain (to ensure we can validate if the requested url is local without dependency on the request)</param>
/// <returns>True if it's an allowed url</returns>
public static bool ValidateProxyUrl(this UrlHelper urlHelper, string url, string callerUrl)
{
if (Uri.IsWellFormedUriString(url, UriKind.RelativeOrAbsolute) == false)
{
return false;
}
/// <summary>
/// Returns the base path (not including the 'action') of the MVC controller "SaveFileController"
/// </summary>
/// <param name="url"></param>
/// <returns></returns>
public static string GetSaveFileServicePath(this UrlHelper url)
if (url.StartsWith("//"))
return false;
Uri requestUri;
if (Uri.TryCreate(url, UriKind.RelativeOrAbsolute, out requestUri))
{
if (string.IsNullOrEmpty(callerUrl) == false)
{
Uri localUri;
if (Uri.TryCreate(callerUrl, UriKind.RelativeOrAbsolute, out localUri))
{
// check for local urls
//Cannot start with // since that is not a local url
if (requestUri.OriginalString.StartsWith("//") == false
//cannot be non-absolute and also contain the char : since that will indicate a protocol
&& (requestUri.IsAbsoluteUri == false && requestUri.OriginalString.Contains(":") == false)
//needs to be non-absolute or the hosts must match the current request
&& (requestUri.IsAbsoluteUri == false || requestUri.Host == localUri.Host))
{
return true;
}
}
else
{
return false;
}
}
//we cannot continue if the url is not absolute
if (requestUri.IsAbsoluteUri == false)
{
return false;
}
// check for valid proxy urls
var feedProxyXml = XmlHelper.OpenAsXmlDocument(IOHelper.MapPath(SystemFiles.FeedProxyConfig));
if (feedProxyXml != null &&
feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)
{
return true;
}
}
else
{
return false;
}
return false;
}
/// <summary>
/// Returns the base path (not including the 'action') of the MVC controller "SaveFileController"
/// </summary>
/// <param name="url"></param>
/// <returns></returns>
public static string GetSaveFileServicePath(this UrlHelper url)
{
var result = url.Action("SavePartialView", "SaveFile", new {area = GlobalSettings.UmbracoMvcArea});
return result.TrimEnd("SavePartialView").EnsureEndsWith('/');
src/umbraco.cms/businesslogic/macro/MacroEngineFactory.cs
+1 -33
View File
@@ -43,39 +43,7 @@ namespace umbraco.cms.businesslogic.macro
_isInitialized = true;
}
}
[Obsolete("Use EnsureInitialize method instead")]
protected static void Initialize()
{
EnsureInitialize();
}
/// <summary>
/// Returns a collectino of MacroEngineLanguage objects, each of which describes a file extension and an associated macro engine
/// </summary>
/// <returns></returns>
/// <remarks>
/// Until the macro engines are rewritten, this method explicitly ignores the PartialViewMacroEngine because this method
/// is essentially just used for any macro engine that stores it's files in the ~/macroScripts folder where file extensions
/// cannot overlap.
/// </remarks>
[Obsolete("This method is not used and will be removed from the codebase in the future")]
public static IEnumerable<MacroEngineLanguage> GetSupportedLanguages()
{
var languages = new List<MacroEngineLanguage>();
foreach(var engine in GetAll())
{
foreach (string lang in engine.SupportedExtensions)
{
if (languages.Find(t => t.Extension == lang) == null)
{
languages.Add(new MacroEngineLanguage(lang, engine.Name));
}
}
}
return languages;
}
}
/// <summary>
/// Returns a collectino of MacroEngineLanguage objects, each of which describes a file extension and an associated macro engine that
src/umbraco.cms/helpers/url.cs
-94
View File
@@ -1,94 +0,0 @@
using System;
using System.Xml;
using System.Text.RegularExpressions;
using Umbraco.Core;
using Umbraco.Core.IO;
using Umbraco.Core.CodeAnnotations;
namespace umbraco.cms.helpers
{
/// <summary>
/// Summary description for url.
/// </summary>
public class url
{
public url()
{
//
// TODO: Add constructor logic here
//
}
[UmbracoWillObsolete("Use Umbraco.Core.StringExtensions.ToUrlSegment() instead.")]
public static string FormatUrl(string url)
{
return url.ToUrlSegment();
}
/// <summary>
/// Utility method for checking for valid proxy urls or redirect urls to prevent Open Redirect security issues
/// </summary>
/// <param name="url">The url to validate</param>
/// <param name="callerUrl">The url of the current local domain (to ensure we can validate if the requested url is local without dependency on the request)</param>
/// <returns>True if it's an allowed url</returns>
public static bool ValidateProxyUrl(string url, string callerUrl)
{
if (!Uri.IsWellFormedUriString(url, UriKind.RelativeOrAbsolute))
{
return false;
}
if (url.StartsWith("//"))
return false;
Uri requestUri;
if (Uri.TryCreate(url, UriKind.RelativeOrAbsolute, out requestUri))
{
if (!string.IsNullOrEmpty(callerUrl))
{
Uri localUri;
if (Uri.TryCreate(callerUrl, UriKind.RelativeOrAbsolute, out localUri))
{
// check for local urls
//Cannot start with // since that is not a local url
if (!requestUri.OriginalString.StartsWith("//")
//cannot be non-absolute and also contain the char : since that will indicate a protocol
&& (!requestUri.IsAbsoluteUri && !requestUri.OriginalString.Contains(":"))
//needs to be non-absolute or the hosts must match the current request
&& (!requestUri.IsAbsoluteUri || requestUri.Host == localUri.Host))
{
return true;
}
}
else
{
//TODO: SD: why throw an exception?? shouldn't we just return false ?
throw new ArgumentException("CallerUrl is in a wrong format that couldn't be parsed as a valid URI. If you don't want to evaluate for local urls, but just proxy urls then leave callerUrl empty", "callerUrl");
}
}
//we cannot continue if the url is not absolute
if (!requestUri.IsAbsoluteUri)
{
return false;
}
// check for valid proxy urls
var feedProxyXml = XmlHelper.OpenAsXmlDocument(IOHelper.MapPath(SystemFiles.FeedProxyConfig));
if (feedProxyXml != null &&
feedProxyXml.SelectSingleNode(string.Concat("//allow[@host = '", requestUri.Host, "']")) != null)
{
return true;
}
}
else
{
//TODO: SD: why throw an exception?? shouldn't we just return false ?
throw new ArgumentException("url is in a wrong format that couldn't be parsed as a valid URI", "url");
}
return false;
}
}
}
src/umbraco.cms/umbraco.cms.csproj
-3
View File
@@ -365,9 +365,6 @@
<Compile Include="businesslogic\workflow\Notification.cs">
<SubType>Code</SubType>
</Compile>
<Compile Include="helpers\url.cs">
<SubType>Code</SubType>
</Compile>
</ItemGroup>
<ItemGroup>
<Content Include="businesslogic\Packager\FileResources\Packages.config" />