diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Create.aspx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Create.aspx index cb1642b64..a56cc2ab8 100644 --- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Create.aspx +++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Create.aspx @@ -6,6 +6,9 @@ <% using (Html.BeginForm()) { %> <%=Html.ValidationSummary() %> <%=Html.EditorForItem(vm => vm.Blog) %> -
- <% } %> +
+ <%=Html.OrchardAntiForgeryToken() %> + +
<% + } %> <% Html.Include("AdminFoot"); %> \ No newline at end of file diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Edit.aspx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Edit.aspx index d0ef55918..cf41724df 100644 --- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Edit.aspx +++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/Blog/Edit.aspx @@ -6,6 +6,9 @@ <% using (Html.BeginForm()) { %> <%=Html.ValidationSummary() %> <%=Html.EditorForItem(m => m.Blog) %> -
- <% } %> +
+ <%=Html.OrchardAntiForgeryToken() %> + +
<% + } %> <% Html.Include("AdminFoot"); %> \ No newline at end of file diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Create.aspx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Create.aspx index 70435b9aa..b987670aa 100644 --- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Create.aspx +++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Create.aspx @@ -1,12 +1,11 @@ <%@ Page Language="C#" Inherits="System.Web.Mvc.ViewPage" %> +<%@ Import Namespace="Orchard.Mvc.Html"%> <%@ Import Namespace="Orchard.Blogs.ViewModels"%> -<%@ Import Namespace="Orchard.Blogs.Extensions"%> -<%@ Import Namespace="Orchard.Security" %> -<%@ Import Namespace="Orchard.Mvc.Html" %> <% Html.Include("AdminHead"); %>

Add Post

- <%using (Html.BeginForm()) { %> - <%= Html.ValidationSummary() %> - <%= Html.EditorForItem(m => m.BlogPost) %> - <% } %> + <% using (Html.BeginForm()) { %> + <%=Html.ValidationSummary() %> + <%=Html.EditorForItem(m => m.BlogPost) %> + <%=Html.OrchardAntiForgeryToken() %><% + } %> <% Html.Include("AdminFoot"); %> \ No newline at end of file diff --git a/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Edit.aspx b/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Edit.aspx index 033dacca6..9493faa72 100644 --- a/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Edit.aspx +++ b/src/Orchard.Web/Packages/Orchard.Blogs/Views/BlogPost/Edit.aspx @@ -1,11 +1,11 @@ <%@ Page Language="C#" Inherits="System.Web.Mvc.ViewPage" %> <%@ Import Namespace="Orchard.Mvc.Html"%> -<%@ Import Namespace="Orchard.Blogs.Extensions"%> <%@ Import Namespace="Orchard.Blogs.ViewModels"%> <% Html.Include("AdminHead"); %>

Edit Post

<% using (Html.BeginForm()) { %> <%=Html.ValidationSummary() %> <%=Html.EditorForItem(m => m.BlogPost) %> - <% } %> + <%=Html.OrchardAntiForgeryToken() %><% + } %> <% Html.Include("AdminFoot"); %> \ No newline at end of file diff --git a/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs b/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs new file mode 100644 index 000000000..78d04a23c --- /dev/null +++ b/src/Orchard/Mvc/Filters/AntiForgeryAuthorizationFilter.cs @@ -0,0 +1,19 @@ +using System.Web.Mvc; + +namespace Orchard.Mvc.Filters { + public class AntiForgeryAuthorizationFilter : FilterProvider, IAuthorizationFilter { + public void OnAuthorization(AuthorizationContext filterContext) { + //TODO: (erikpo) Once all modules are moved over to use the AntiForgeryToken, get rid of this if statement + if (!(filterContext.RouteData.Values["area"] is string + && (string)filterContext.RouteData.Values["area"] == "Orchard.Blogs")) + return; + + if (!(filterContext.HttpContext.Request.HttpMethod == "POST" && filterContext.RequestContext.HttpContext.Request.IsAuthenticated)) + return; + + ValidateAntiForgeryTokenAttribute validator = new ValidateAntiForgeryTokenAttribute { Salt = "Orchard" }; + + validator.OnAuthorization(filterContext); + } + } +} \ No newline at end of file diff --git a/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs b/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs index 3ae4d392c..b411f3b71 100644 --- a/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs +++ b/src/Orchard/Mvc/Html/HtmlHelperExtensions.cs @@ -175,5 +175,16 @@ namespace Orchard.Mvc.Html { } #endregion + + #region OrchardAntiForgeryToken + + public static MvcHtmlString OrchardAntiForgeryToken(this HtmlHelper htmlHelper) + { + //TODO: (erikpo) Change the salt to be something unique per application like a site setting with a Guid.NewGuid().ToString("N") value + + return htmlHelper.AntiForgeryToken("Orchard"); + } + + #endregion } } diff --git a/src/Orchard/Orchard.csproj b/src/Orchard/Orchard.csproj index a96e86f1e..222d8ce99 100644 --- a/src/Orchard/Orchard.csproj +++ b/src/Orchard/Orchard.csproj @@ -196,6 +196,7 @@ +