Commit Graph

11524 Commits

Author SHA1 Message Date
Matteo Piovanelli
526a652ab5
bump version for owin packages. (#8616) 2022-09-16 08:46:47 +02:00
Sébastien Ros
5bb6c8b27e
Create SECURITY.md 2022-08-04 10:03:47 -07:00
Matteo Piovanelli
63cfe7babe
Fix/cache by role exception (#8574) 2022-07-08 16:52:30 +02:00
Hermes Sbicego
f2ec2a70cd
Fix/newtonsoft.json 13.0.1 (#8596)
* Bump Newtonsoft.Json from 12.0.3 to 13.0.1 in /src/Orchard

Bumps [Newtonsoft.Json](https://github.com/JamesNK/Newtonsoft.Json) from 12.0.3 to 13.0.1.
- [Release notes](https://github.com/JamesNK/Newtonsoft.Json/releases)
- [Commits](https://github.com/JamesNK/Newtonsoft.Json/compare/12.0.3...13.0.1)

---
updated-dependencies:
- dependency-name: Newtonsoft.Json
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump Newtonsoft.Json from 12.0.3 to 13.0.1 in /src/Orchard.Azure.Tests

Bumps [Newtonsoft.Json](https://github.com/JamesNK/Newtonsoft.Json) from 12.0.3 to 13.0.1.
- [Release notes](https://github.com/JamesNK/Newtonsoft.Json/releases)
- [Commits](https://github.com/JamesNK/Newtonsoft.Json/compare/12.0.3...13.0.1)

---
updated-dependencies:
- dependency-name: Newtonsoft.Json
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Updates Newtonsoft.Json from 12.0.3 to 13.0.1

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-05 09:30:08 +02:00
Andrea Piovanelli
64fad63e02
Fixed search function when searching inside the "Recent" folder. (#8568) 2022-06-17 08:51:10 +02:00
Andrea Piovanelli
520dc06b46
8557 check valid taxonomy (#8558)
* Added checks on taxonomyId validity (it needs to be > 0) before executing queries that would return no result.

* Added id check on GetTaxonomy(int id) functions.

* Added id check on GetTerm(int id)

* Removed id check on GetTaxonomy(int) function to avoid changing previous behaviour.

* Returned "Array.Empty" instead of "new List" where an empty list must be returned.
2022-06-17 08:50:43 +02:00
Andrea Piovanelli
aff9b2542c
Fix to replace media when original file has been deleted from filesystem (#8555)
* Added statuses management instead of notifier when catching file not found exception

# Conflicts:
#	src/Orchard.Web/Modules/Orchard.MediaLibrary/Controllers/ClientStorageController.cs

* Visual studio automatic code formatting.
2022-04-29 15:33:23 +02:00
Matteo Piovanelli
aed260544d
Fixes #8550 (#8551)
* Added permissions allowing management of users belonging to specific roles only

* Added condition to manage superuser

* Fixed the case where an user with no special ManageUserByRole Permission would
end up being able to manage a user with no role, because of the behavior of
Enumerable.All on empty collections.
2022-04-08 08:45:56 +02:00
Andrea Piovanelli
ffb56e684c
8541 password history (#8542)
* Added password history management to back office user password edit and made it working via IUserEventHandler calls.

* Added "password" parameter to "ChangedPassword" call.
2022-03-18 12:26:19 +01:00
Matteo Piovanelli
f2a8450d90
Roles management (#8535)
* Started adding roles that will be used to to allow users the ability to assign
specific roles to others.

* small refactor of the method to return dynamic AssignRole permissions

* Implemented permissions to limit the ability of a user to assign specific
roles

* controller action to assign roles

* Refactored Assign action in roles admin Controller
Fixed a bug in figuring out the id of roles to assign
Added provider to add action links to list of users in BO
Added "cancel" button to page to assign roles, based on returnUrl
2022-02-09 10:23:34 +01:00
dependabot[bot]
0d410d5ec6
Bump SharpZipLib from 1.3.1 to 1.3.3 in /src/Orchard.Web/Modules/Lucene (#8536) 2022-02-03 10:07:17 -08:00
Matteo Piovanelli
e9244980a4
Upgrade nhibernate (#8528)
* Upgraded NHibernate to version 5.3.10. Solution builds with no warnings.

* fixed most issues

* Added source code for NHibernate.Linq library from
http://sourceforge.net/projects/nhcontrib/files/NHibernate.Linq/1.0/NHibernate.Linq-1.0.0.GA-src.zip
With the modified DetachedCriteriaAdapter.cs for Orchard.
Started upgrading that library to NHibernate 5.3.10.

* Finished updating NHibernate.Linq to work with NHibernate 5.3.10.

* Removed NHibernate.Linq from lib folder

* Updated code generation templates to use the correct version of nhibernate
2022-01-21 08:47:00 +01:00
Matteo Piovanelli
a5c28edb44
Added two constructors to CreateUserParams. (#8530)
One is a restoration of the former constructor with 6 parameters.
The other is a 3 parameters constructor using common defaults for the other
properties.
2022-01-21 08:46:07 +01:00
Hermes Sbicego
412a21873a
GetPhysicalPath returns error if url contains '?' (#8526)
* GetPhysicalPath returns error if url contains '?'

Fixes

* Update ResourceDefinition.cs

Co-authored-by: Sébastien Ros <sebastienros@gmail.com>
Co-authored-by: matteo.piovanelli <matteo.piovanelli@laser-group.com>
2022-01-14 10:53:43 +01:00
Matteo Piovanelli
b042873252
extend users and roles capabilities (#8523)
* Adds the capability to set a user to forcely change its own password at next LogOn

* Force user to not reuse last n passwords

* Moves IPasswordService implementation to Orchard Users
Creates Extensions to share management of Password operations across Services

* Some refactoring

* Password History Policy:
- New User Evente (ChangingPassword)
- Settings to enable the policy
- Security service interfaces to abstract history management
- User service implementations to concretely manage history

* PasswordHistoryPolicy:
- keep in count the password stored within the UserPart as a not reusable password

* WIP automated suspension of inactive users

* Disable users that have been inactive for longer than a specified number of
days, except when they are SiteOwner, or they have a specific flag set to
prevent their suspension.

* Provider to prevent suspension of users based on assigned roles

* cleanup. Refactor of migrations.

* Added action to ask for the challenge email to be resent.
Challenge email is sent again if a user tries to register anew with an email
address they had used to create an account earlier if the email address isn't
validated yet.

* During registration, if a user inserts the information of an existing account
and that account should still validate its email address, the user is presented
a link to request a new challenge email to be sent.

* Added a link to the action to request a new challenge email in the case when
the nonce fails to validate.

* Renamed part and corresponding record.
Added ability to "protect" specific users from having to change password when
it is expired / too old.

Co-authored-by: HermesSbicego-Laser <hermes.sbicego@laser-group.com>
2022-01-14 10:32:07 +01:00
Matteo Piovanelli
1e1668fdc2
Abstracted account validation (#7944)
* Added a service to abstract some account validation away from the AccountController, so it's easier to upgrade it and use the same validation elsewhere.

* Added a validation context to carry information used for validation of account
information.

* Refactored password validation in the AccountController

* Updated tests

* fixed value read from context.ValidationSuccessful
2022-01-14 09:36:26 +01:00
Matteo Piovanelli
91a82535a2
1.10.x into dev (#8521)
* Added tokenizable default value to ContentPickerFields (#8351)

* Fixes errors during Indexing (#8349)

* Added admin search permissions (#8346)

* Reuse Settings_ShellDescriptorRecord during an http request (#8355)

* Added a new index to CommonPartRecord (#8362)

* Attempted AutoroutePart improvement (#8360)

This should ease Database issues, because it short circuits some code paths
through aliases.

* Save MemberBindingRecords in memory (#8371)

Prevent fetching the same table from the database 5+ times per request by
loading it and saving it in a private property for a request.

* Cache list of configured layers (#8373)

On every page load on frontend we were querying for all existing layers to test
for the ones that are currently active. Since that information is not bound to
change often, we added a cache layer to prevent querying every time. The cache
is evicted whenever a Layer gets updated.

* Memorize query results in blog service (#8374)

The query for all published blogs is being called twice while building the admin menu,
so we are memorizing its results.

* Updated UI for projections (#8380)

Some textboxes were too small for the actual text users would generally write in them.
Those meant to hold HTML have been converted to textareas.

* Process ignored paths while being aware of RequestUrlPrefix (#8384)

* Process ignored paths while being aware of RequestUrlPrefix

* Fix: I had moved a Trim to the wrong place

* Fixed issue with empty/uninitialized null set of ignored urls

* tokens sort criteria (#8382)

* Tokenized state for sort criteria

* Tokenized state also in the other place where sort criteria are used

* Remove lock from the dictionary when the task has completed. (#8395)

Fixes #8391

* Update DistributedLockService.cs (#8398)

* fix for CPF when other scripts are also adding to sessionStorage (#8404)

* Fixes Boolean Conversion error (#8393)

* Fix/8392 remeber me model state exception (#8410)

@sebastienros this fixes the possible NRE that would happen for absent models from merged #8393 
(see your comment there https://github.com/OrchardCMS/Orchard/pull/8393#issuecomment-686630198)

* Removed changes to model bindings (#8412)

This is the same as reverting 1.10.x to commit 868ce12ad6

* New version of Boolean Binder Provider (#8413)

* New version of Boolean Binder Provider
* Use Convert.ToBoolean(string) rather than ValueProviderResult.ConvertTo(bool)

* Upgrade host resolution (#8387)

* Reverted changes to RunningShellTable and then changed the way shells are sorted,
so we can correctly give "priority" to tenants based on their prefix.

Added test adapter reference to Orchard.Framework.Tests so tests can be run in
the latest VS 2017.

Fixed a test that was failing to account for the order the shells were being
processed.

* Removed some stuff from csproj that vs had added

* Handle the case where a form sends more than one attempted value for a boolean (#8416)

* fix record mapping nhibernate (#8415)

* Allow downstream methods to set default value (#8419)

Moreover, this won't try to set a default value to the bool when it's not sent.
This will allow calls with missing required parameters to fail as they should.

* Fixed Media Library Picker Style  (#8433)

* Removed check preventing reassignment of loader delegates (#8436)

* Added an event activity for workflows that activates on the first Upd… (#8438)

* target framework 4.8 to all projects (#8444)

* Feature/8445 libraries update (#8446)

* Fixed conflict with style for layouts (#8456)

the .overlay is used for different things in MediaLibraryPickerField and Layouts, and as it was the styles would conflict. This should fix it.

* Feature/upgradable libraries (#8457)

* Updated Migration for CommonPartRecord and IdentityPartRecord (#8459)

This orders the operations differently than what is in dev for retrocompatibility in both environments.

* Prevents throwing exception when Href is null (#8461)

* added culture in widgets page (#8466)

* added culture in widgets page
Co-authored-by: elena.lampugnani <elena.lampugnani@laser-group.com>
Co-authored-by: Hermes Sbicego <hermes.sbicego@laser-group.com>

* Show disable action for deprecated features even if they are categorized as "Core" (#8468)

* Upgrades YamlDotNet from 9.1.3 to 11.1.1 because 9.1.3 is not more available as nuget package (#8472)

* Bypass cache for XSRF Tokens (#8470)

Fixes #8469

* flag exclude children for taxonomies (#8481)

* Remove cache by tag on Unpublished (#8483)

As it was, cached lists/projections would not be evicted when a ContentItem they contained was unpublished.

* Cloning doesn't overwrite identity (#8487)

Fixes #8486

* Update nhibernate (#8488)

* Update nHibernate to version 4.1.2.4000

# Conflicts:
#	src/Orchard.Web/Modules/Orchard.ContentPicker/packages.config
#	src/Orchard.Web/Modules/Orchard.ImportExport/packages.config
#	src/Orchard.Web/Modules/Orchard.MessageBus/packages.config
#	src/Orchard.Web/Modules/Orchard.MultiTenancy/packages.config
#	src/Orchard.Web/Modules/Orchard.Projections/packages.config
#	src/Orchard.Web/Modules/Orchard.Tags/packages.config
#	src/Orchard.Web/Modules/Upgrade/packages.config
#	src/Orchard.Web/Web.config

* Update AssemblyBindings for NHibernate

* Fixes disposed LifetimeScope issue (#8490)

* fixed scope in in recomputing the context to figure out whether an antiforgery token needs replacing

* Revert "Cloning doesn't overwrite identity (#8487)" (#8495)

This reverts commit af42947c9c.

* Remove whitespace when importing list of permissions (#8499)

Similarly to what's already being done when we import features.
this allows to go to a new line in the xml that we import, and even tabulate for readability and maintenance.

* Force enumeration of list of permissions. 

Without this, imported permissions (#8492) would always replace existing ones: i.e. if an existing permission is not in
the list being imported it would be removed for the role.

* Projection default settings (#8497)

* added settings in projection part
* read settings into driver
* commit files setting
* add logic of filter query
* added logic of filter query setting
* managed import/export
* fixed migration
* added message information
Co-authored-by: elena.lampugnani <elena.lampugnani@laser-group.com>

* HtmlDecode token (#8501)

Added HtmlDecode token management.
Needed for #8500

* Sets SSL redirection as permanent for SEO reasons (#8503)

Fixes #8502

* Added null checks (#8511)

The added null checks manage properly importing definitions that do not contain the properties.

* Fix/editmenulink (#8515)

* Removed useless spaces

* Corrections on ProjectionPart query link (it didn't update the link when changing the selected query).
Added edit link for menu in MenuWidget.

* Added menuId parameter to menu edit link

* Fixed various typos: (#8512)

* Added descriptor to audit trail context (#8517)

Co-authored-by: Hermes Sbicego <hermes.sbicego@laser-group.com>
Co-authored-by: Imran Azad <imranazad@users.noreply.github.com>
Co-authored-by: LorenzoFrediani-Laser <lorenzo.frediani@laser-group.com>
Co-authored-by: ElenaRepository <50620495+ElenaRepository@users.noreply.github.com>
Co-authored-by: Andrea Piovanelli <83577153+AndreaPiovanelliLaser@users.noreply.github.com>
2022-01-14 09:11:12 +01:00
ElenaRepository
5e5bf19863
Different cache key by role (#8510)
* feature: adds roles and permissions of the user in to cache key
2021-10-29 08:41:11 +02:00
Andrea Piovanelli
be55aad08a
Fixed various typos: (#8513) 2021-10-25 09:21:00 +02:00
Matteo Piovanelli
3336be6c77
Cloning doesn't overwrite identity (#8496)
Fixes #8486
2021-09-24 08:38:01 +02:00
Matteo Piovanelli
10963275c3
Actually signout user on change password. (#8478)
This is controlled by the existing setting that would invalidate all extant auth cookies on change password.
2021-05-28 08:45:14 +02:00
Matteo Piovanelli
d2d77f78eb
Added ability to log out missing translations (#8477) 2021-05-28 08:44:32 +02:00
Matteo Piovanelli
7f6ccaf240
Refactored method body to protected method (#8476) 2021-05-24 09:31:12 +02:00
ElenaRepository
3ce2fc5f9e
fixed validation of the LocalizationPart (#8464) 2021-04-19 11:04:14 +02:00
Matteo Piovanelli
ca86ec9831
merge 1.10.x into dev 2021-02-19 10:31:26 +01:00
Matteo Piovanelli
8badf8aaf6
Logs out disabled users (#8455)
#8454 invalidates auth cookie for users on disabling them
2021-02-11 19:25:48 +01:00
Matteo Piovanelli
eebb22edbf
Fix/8439 hql sort factory (#8440)
* Additional methods to extend the sort capabilities for projections

* Added some comments
2020-12-18 08:34:17 +01:00
Aaron Amm
0cadd5a916
Improve build script to not fail when there is JS warning (#8422)
* Improve build script to not fail when JS warning wrote to standard error

* Update nuget.exe to version 5.7.0 and explicit set MSBuild path for it.
2020-12-03 10:14:14 -08:00
Aaron Amm
1c93e4a501
Add FromName and ReplyTo properties to SmtpSettingsPart (#8420) 2020-10-15 10:10:26 -07:00
Matteo Piovanelli
70c04a9a5f
Prevent NREs for null text (#8418)
When the text we are localizing is null (which potentially happens when localizing dynamic content), it could result in a null parent translation, which would throw when used as "basis" for comparisons.
2020-09-21 12:10:31 +02:00
DiegoMarguerettaz-Laser
0d3f3ed9f3
Issue #8318: Managing multiple scopes in localization concurrent dictionary. (#8334)
* Manage multiple scopes in localization concurrent dictionary (issue 8318)

Co-authored-by: matteo.piovanelli <matteo.piovanelli@laser-group.com>
2020-09-18 08:40:09 +02:00
Hermes Sbicego
87477518fa
Fix wrong behaviours and exceptions when blog is unpublished. (#8389)
* Fix wrong behaviours and exceptions when blog is unpublished. More details there #8388.
2020-07-10 08:31:11 +02:00
Matteo Piovanelli
b82e232e38
Fix/8376 nolock subqueries (#8377)
* NolockInterceptor handles subqueries now
The parser as it was ignored subqueries completely. Now it treats them as queries
and places them back in their parent queries.
2020-05-15 08:36:52 +02:00
Hermes Sbicego
cf1d91f0b2
Prevent loosing contentId when Model has errors (#8358) 2020-05-14 10:30:47 -07:00
Matteo Piovanelli
d85ff5fa37
Fix/8354 caching (#8364)
* Caching the ShellDescriptor
This avoids fetching all connected records on every request.
refreshed cache after an update
This is after having evicted it and having updated the database
2020-05-08 08:31:33 +02:00
Matteo Piovanelli
e520a178aa
Fix for TermContentItem deadlocks (#8368)
Now it should only fetch the id, which is what we need, rather than the
whole record, so it should be able to correctly take advantage of the indexes

Try to not fetch terms back from the database right as we do an update, by
using what is in the view model we just updated
2020-05-07 10:40:54 -07:00
Matteo Piovanelli
35738c1b58
Added indexes for common queries (#8369) 2020-05-07 10:39:35 -07:00
Matteo Piovanelli
9d1267a94c
localizationpartdriver refactor (#8366)
* Performance on LocalizationPart
Prevent driver from repeating the same query several times in a request (it used
to try and fetch all of a part's localizations at least twice per request).
Changed query for a MasterContentItem's localizations so it should "hint" sql to
use different indexes.
2020-05-07 10:27:58 -07:00
Hermes Sbicego
8a327cf887
Removes useless and case sensitive check (#8352)
That check was useless because we use a int.TryParse. Morevoer queryString.AllKeys.Contains() is case sensitive.
2020-04-23 10:11:07 -07:00
Steven Dawkins
914b5f8391
Made RazorCompiler ILogger property public to allow ILogger to be injected (#8343) 2020-04-16 10:24:43 -07:00
Zoltán Lehóczky
b960866531 Merge branch '1.10.x' into dev
# Conflicts:
#	src/Orchard.Web/Modules/Markdown/Markdown.csproj
#	src/Orchard.Web/Modules/Orchard.Projections/Handlers/FieldIndexPartHandler.cs
#	src/Orchard.Web/Modules/Orchard.Recipes/Views/Admin/Index.cshtml
#	src/Orchard.Web/Modules/Orchard.Taxonomies/Views/TermAdmin/Index.cshtml
#	src/Orchard.sln
2020-04-07 23:03:58 +02:00
Lombiq
dbc1e61069 Adding NuGet config file to keep packages in the packages folder and thus be able to build the solution with the current NuGet version 2020-04-07 22:06:10 +02:00
Hermes Sbicego
b54d2fadc0
CustomForms throws an error when used within a Widget (#8338) 2020-04-02 10:12:55 -07:00
ElenaRepository
55f0115459
replace code with static method (#8337)
Co-authored-by: elena.lampugnani <elena.lampugnani@laser-group.com>
2020-03-26 12:03:56 -07:00
Hermes Sbicego
e4b251b9ce
- Moved condition of ContentType not null in a try catch statement to handle the case the ContentItem was destroyed (#8335) 2020-03-19 12:05:53 -07:00
Sébastien Ros
27e6401965
Add a fake transparent background for image thumbnails (#8329) 2020-03-05 14:35:11 -08:00
Sébastien Ros
fb220a60a3
Add button manage approve disable in edit user (#8321) 2020-03-05 12:06:11 -08:00
Hermes Sbicego
5015809444
Adds a link "View" in "Admin/Index.cshtml" to see how it looks the Taxonomony on the front-end (#8323)
Fixes #8322
2020-02-13 12:09:35 -08:00
Matteo Piovanelli
937702479c
Tabs and Cards to better organize parts and fields (#8310) 2020-02-06 12:16:16 -08:00
Aaron Amm
e4ac0c02bc
Convert Kudu custom script to PowerShell (#8315) 2020-02-06 12:15:46 -08:00