Applying security fix

http://docs.orchardproject.net/Documentation/Patch-20150519

.hgtags

@@ -28,3 +28,4 @@ cfc1cec81fee0b1e1016bf27b5775467eb250839 1.4
 8ed0034d0b454586ed6943a5099f6a91934c4330 1.4.1
 4ec7a156eaff54961491422d1001a8e21bf119e6 1.6-rc
 f9b5789dac27dc9b63c1914e7cb31efae3ed2820 1.6
+cf19e17e0ec6a791ccb155eefcdfc77282a6f86e 1.6.1

src/Orchard.Web/Modules/Orchard.Comments/Controllers/CommentController.cs

@@ -1,5 +1,4 @@
 using System;
-using System.Linq;
 using System.Web.Mvc;
 using Orchard.Comments.Models;
 using Orchard.Comments.Services;
@@ -13,12 +12,10 @@ namespace Orchard.Comments.Controllers {
     public class CommentController : Controller {
         public IOrchardServices Services { get; set; }
         private readonly ICommentService _commentService;
-        private readonly INotifier _notifier;
 
-        public CommentController(IOrchardServices services, ICommentService commentService, INotifier notifier) {
+        public CommentController(IOrchardServices services, ICommentService commentService) {
             Services = services;
             _commentService = commentService;
-            _notifier = notifier;
             T = NullLocalizer.Instance;
         }
 
@@ -32,6 +29,22 @@ namespace Orchard.Comments.Controllers {
             var viewModel = new CommentsCreateViewModel();
 
             TryUpdateModel(viewModel);
+
+            if (!ModelState.IsValidField("Name")) {
+                Services.Notifier.Error(T("Name is mandatory and must have less than 255 chars"));
+            }
+
+            if (!ModelState.IsValidField("Email")) {
+                Services.Notifier.Error(T("Email is invalid or is longer than 255 chars"));
+            }
+
+            if (!ModelState.IsValidField("Site")) {
+                Services.Notifier.Error(T("Site url is invalid or is longer than 255 chars"));
+            }
+
+            if (!ModelState.IsValidField("CommentText")) {
+                Services.Notifier.Error(T("Comment is mandatory"));
+            }
             
             var context = new CreateCommentContext {
                 Author = viewModel.Name,
@@ -41,7 +54,6 @@ namespace Orchard.Comments.Controllers {
                 CommentedOn = viewModel.CommentedOn
             };
 
-
             if (ModelState.IsValid) {
                 if (!String.IsNullOrEmpty(context.SiteName) && !context.SiteName.StartsWith("http://") && !context.SiteName.StartsWith("https://")) {
                     context.SiteName = "http://" + context.SiteName;
@@ -60,12 +72,6 @@ namespace Orchard.Comments.Controllers {
                 }
             }
             else {
-                foreach (var error in ModelState.Values.SelectMany(m => m.Errors).Select( e=> e.ErrorMessage)) {
-                    _notifier.Error(T(error));
-                }
-            }
-
-            if(!ModelState.IsValid) {
                 TempData["CreateCommentContext.Name"] = context.Author;
                 TempData["CreateCommentContext.CommentText"] = context.CommentText;
                 TempData["CreateCommentContext.Email"] = context.Email;

src/Orchard.Web/Modules/Orchard.Comments/Module.txt

@@ -2,7 +2,7 @@
 AntiForgery: enabled
 Author: The Orchard Team
 Website: http://orchardproject.net
-Version: 1.6
+Version: 1.6.1
 OrchardVersion: 1.4
 Description: The comments system implemented by this module can be applied to arbitrary Orchard content types, such as blogs and pages. It includes comment validation and spam protection through the Akismet service.
 Features:

src/Orchard.Web/Modules/Orchard.Comments/ViewModels/CommentsCreateViewModel.cs

@@ -3,17 +3,18 @@ using System.ComponentModel.DataAnnotations;
 
 namespace Orchard.Comments.ViewModels {
     public class CommentsCreateViewModel {
+
         [Required]
         [StringLength(255)]
         public string Name { get; set; }
 
-        [RegularExpression(@"^[^@\s]+@[^@\s]+$", ErrorMessage = "Invalid Email")]
+        [RegularExpression(@"^(?![\.@])(""([^""\r\\]|\\[""\r\\])*""|([-a-z0-9!#$%&'*+/=?^_`{|}~]|(?<!\.)\.)*)(?<!\.)@[a-z0-9][\w\.-]*[a-z0-9]\.[a-z][a-z\.]*[a-z]$")]
         [StringLength(255)]
         public string Email { get; set; }
 
         [StringLength(245)]
         [DisplayName("Site")]
-        [RegularExpression(@"^(http(s)?://)?([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}[\S]+$", ErrorMessage = "Invalid url")]
+        [RegularExpression(@"^(http(s)?://)?([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}[\S]+$")]
         public string SiteName { get; set; }
 
         [Required, DisplayName("Comment")]

src/Orchard.Web/Modules/Orchard.Users/Controllers/AdminController.cs

@@ -293,6 +293,7 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
+        [HttpPost]
         public ActionResult SendChallengeEmail(int id) {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
@@ -313,7 +314,9 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
-        public ActionResult Approve(int id) {
+        [HttpPost]
+        public ActionResult Approve(int id)
+        {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
 
@@ -330,7 +333,9 @@ namespace Orchard.Users.Controllers {
             return RedirectToAction("Index");
         }
 
-        public ActionResult Moderate(int id) {
+        [HttpPost]
+        public ActionResult Moderate(int id)
+        {
             if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
                 return new HttpUnauthorizedResult();
 

src/Orchard.Web/Modules/Orchard.Users/Views/Admin/Index.cshtml

@@ -71,12 +71,12 @@
                     @Html.ActionLink(T("Edit").ToString(), "Edit", new { entry.User.Id }) |
                     @Html.ActionLink(T("Delete").ToString(), "Delete", new { entry.User.Id}, new { itemprop = "RemoveUrl UnsafeUrl" }) |
                     @if (entry.User.RegistrationStatus == UserStatus.Pending) {
-                        @Html.ActionLink(T("Approve").ToString(), "Approve", new { entry.User.Id })
+                        @Html.ActionLink(T("Approve").ToString(), "Approve", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
                     } else {
-                        @Html.ActionLink(T("Disable").ToString(), "Moderate", new { entry.User.Id })
+                        @Html.ActionLink(T("Disable").ToString(), "Moderate", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
                     }
                     @if (entry.User.EmailStatus == UserStatus.Pending) { <text>|</text>
-                        @Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { entry.User.Id })
+                        @Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
                     } 
                 </td>
             </tr>

src/Orchard/Properties/AssemblyInfo.cs

@@ -35,6 +35,6 @@ using System.Security;
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
 
-[assembly: AssemblyVersion("1.6")]
-[assembly: AssemblyFileVersion("1.6")]
+[assembly: AssemblyVersion("1.6.1")]
+[assembly: AssemblyFileVersion("1.6.1")]