lsm/Orchard
1
0
Fork 0
mirror of https://github.com/OrchardCMS/Orchard.git synced 2025-10-14 19:04:51 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Security patch for MSA 2416728

Browse Source
This commit is contained in:
Sebastien Ros
2010-09-20 16:50:12 -07:00
parent 337e8e15e1
commit 7ba469cd9a
8 changed files with 102 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
src/Orchard.Azure/Orchard.Azure.Web/Error.aspx Normal file
View File

@@ -0,0 +1,27 @@
<%@ Page Language="C#" AutoEventWireup="true" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<%@ Import Namespace="System.Threading" %>
<script runat="server">
void Page_Load() {
byte[] delay = new byte[1];
RandomNumberGenerator prng = new RNGCryptoServiceProvider();
prng.GetBytes(delay);
Thread.Sleep((int)delay[0]);
IDisposable disposable = prng as IDisposable;
if (disposable != null) { disposable.Dispose(); }
}
</script>
<html>
<head id="Head1" runat="server">
<title>Error</title>
</head>
<body>
<div>
An error occurred while processing your request.
</div>
</body>
</html>

1
src/Orchard.Azure/Orchard.Azure.Web/Orchard.Azure.Web.csproj
View File

@@ -146,6 +146,7 @@
<Compile Include="WebRole.cs" />
</ItemGroup>
<ItemGroup>
<Content Include="Error.aspx" />
<Content Include="Global.asax" />
</ItemGroup>
<ItemGroup>

22
src/Orchard.Azure/Orchard.Azure.Web/Web.config
View File

@@ -87,7 +87,7 @@
it enables developers to configure html error pages
to be displayed in place of a error stack trace.
-->
<customErrors mode="Off"/>
<customErrors mode="RemoteOnly" redirectMode="ResponseRewrite" defaultRedirect="~/Error.aspx"/>
<pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
<namespaces>
<add namespace="System.Web.Mvc"/>
@@ -100,6 +100,16 @@
</namespaces>
</pages>
<httpHandlers>
<!-- Explicitly remove not necessary handlers -->
<remove path="eurl.axd" verb="*" />
<remove path="trace.axd" verb="*" />
<remove path="WebResource.axd" verb="*" />
<remove path="*_AppService.axd" verb="*" />
<remove path="ScriptResource.axd" verb="*" />
<remove path="*.rem" verb="*" />
<remove path="*.xoml" verb="*" />
<remove path="*.xamlx" verb="*" />
<add verb="*" path="*.mvc" validate="false" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
</httpHandlers>
</system.web>
@@ -113,6 +123,16 @@
<modules runAllManagedModulesForAllRequests="true">
</modules>
<handlers>
<!-- Explicitly remove not necessary handlers -->
<remove path="eurl.axd" verb="*" />
<remove path="trace.axd" verb="*" />
<remove path="WebResource.axd" verb="*" />
<remove path="*_AppService.axd" verb="*" />
<remove path="ScriptResource.axd" verb="*" />
<remove path="*.rem" verb="*" />
<remove path="*.xoml" verb="*" />
<remove path="*.xamlx" verb="*" />
<remove name="MvcHttpHandler"/>
<remove name="UrlRoutingHandler"/>
<add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>

1
src/Orchard.Specs/Orchard.Specs.csproj
View File

@@ -182,6 +182,7 @@
</Content>
<Content Include="Hosting\Orchard.Web\Core\Web.config">
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
<SubType>Designer</SubType>
</Content>
<Content Include="Hosting\Orchard.Web\Themes\Web.config">
<CopyToOutputDirectory>Always</CopyToOutputDirectory>

27
src/Orchard.Web/Error.aspx Normal file
View File

@@ -0,0 +1,27 @@
<%@ Page Language="C#" AutoEventWireup="true" %>
<%@ Import Namespace="System.Security.Cryptography" %>
<%@ Import Namespace="System.Threading" %>
<script runat="server">
void Page_Load() {
byte[] delay = new byte[1];
RandomNumberGenerator prng = new RNGCryptoServiceProvider();
prng.GetBytes(delay);
Thread.Sleep((int)delay[0]);
IDisposable disposable = prng as IDisposable;
if (disposable != null) { disposable.Dispose(); }
}
</script>
<html>
<head id="Head1" runat="server">
<title>Error</title>
</head>
<body>
<div>
An error occurred while processing your request.
</div>
</body>
</html>

1
src/Orchard.Web/Orchard.Web.csproj
View File

@@ -97,6 +97,7 @@
</ItemGroup>
<ItemGroup>
<Content Include="Default.aspx" />
<Content Include="Error.aspx" />
<Content Include="Global.asax" />
<Content Include="Refresh.html" />
<Content Include="Themes\Contoso\Styles\search.css" />

22
src/Orchard.Web/Web.config
View File

@@ -87,7 +87,7 @@
it enables developers to configure html error pages
to be displayed in place of a error stack trace.
-->
<customErrors mode="Off"/>
<customErrors mode="RemoteOnly" redirectMode="ResponseRewrite" defaultRedirect="~/Error.aspx"/>
<pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
<namespaces>
<add namespace="System.Web.Mvc"/>
@@ -100,6 +100,16 @@
</namespaces>
</pages>
<httpHandlers>
<!-- Explicitly remove not necessary handlers -->
<remove path="eurl.axd" verb="*" />
<remove path="trace.axd" verb="*" />
<remove path="WebResource.axd" verb="*" />
<remove path="*_AppService.axd" verb="*" />
<remove path="ScriptResource.axd" verb="*" />
<remove path="*.rem" verb="*" />
<remove path="*.xoml" verb="*" />
<remove path="*.xamlx" verb="*" />
<add verb="*" path="*.mvc" validate="false" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
</httpHandlers>
</system.web>
@@ -113,6 +123,16 @@
<modules runAllManagedModulesForAllRequests="true">
</modules>
<handlers>
<!-- Explicitly remove not necessary handlers -->
<remove path="eurl.axd" verb="*" />
<remove path="trace.axd" verb="*" />
<remove path="WebResource.axd" verb="*" />
<remove path="*_AppService.axd" verb="*" />
<remove path="ScriptResource.axd" verb="*" />
<remove path="*.rem" verb="*" />
<remove path="*.xoml" verb="*" />
<remove path="*.xamlx" verb="*" />
<remove name="MvcHttpHandler"/>
<remove name="UrlRoutingHandler"/>
<add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>

12
src/Orchard/Mvc/Results/NotFoundResult.cs
View File

@@ -1,17 +1,11 @@
using System.Net;
using System.Web;
using System.Web.Mvc;
namespace Orchard.Mvc.Results {
public class NotFoundResult : ViewResult {
public override void ExecuteResult(ControllerContext context) {
ViewName = "NotFound";
ViewData = context.Controller.ViewData;
TempData = context.Controller.TempData;
base.ExecuteResult(context);
context.HttpContext.Response.StatusDescription = "File Not Found";
context.HttpContext.Response.StatusCode = 404;
throw new HttpException((int)HttpStatusCode.NotFound, "Resource not found");
}
}
}