lsm/Orchard
1
0
Fork 0
mirror of https://github.com/OrchardCMS/Orchard.git synced 2026-02-09 09:16:41 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Compare commits

base: lsm:feature/asyncscripts
Branches Tags
lsm:dev lsm:BenedekFarkas/recycle-bin-improvements lsm:issue/8888 lsm:issue/8268 lsm:BenedekFarkas/fix-user-publish-button lsm:issue/8884 lsm:issue/8879 lsm:issue/8881 lsm:issue/8878 lsm:issue/8479 lsm:issue/8208 lsm:issue/8859 lsm:issue/7412 lsm:task/nuget-updates lsm:issue/8525 lsm:issue/8759 lsm:1.10.x-to-dev lsm:1.10.x lsm:issue/8850 lsm:issue/8830 lsm:BenedekFarkas/release-package-workflow lsm:BenedekFarkas/index-name-validation lsm:BenedekFarkas/windows-2025-runners-1.10.x lsm:BenedekFarkas/fix-gulp-pipeline-install lsm:issue/8822 lsm:issue/8800 lsm:issue/8232 lsm:issue/8819 lsm:issue/6992 lsm:issue/8276 lsm:issue/8816 lsm:issue/8814 lsm:issue/8811 lsm:issue/8752 lsm:issue/8808 lsm:issue/8791 lsm:issue/6193/htmlfilter lsm:issue/6748 lsm:issue/8786 lsm:issue/8773 lsm:issue/8225 lsm:issue/8773-1.10.x lsm:issue/8776 lsm:issue/8686-dev lsm:issue/8684 lsm:issue/8710 lsm:issue/8686 lsm:MatteoPiovanelli-Laser-patch-1 lsm:issue/8642 lsm:Prevent-caching-GetTaxonomy-Action lsm:revert-8410-fix/8392_RemeberMeModelStateException lsm:issue/7713 lsm:autoroute-concurrency lsm:fileformatter lsm:feature/admin-theme lsm:issues/7747/recaptcha lsm:master lsm:1.10.2 lsm:issue/7467 lsm:blogpermissions lsm:issue/6991/owin-workcontextscope lsm:azureauth lsm:feature/deployments lsm:feature/canopy lsm:feature/6838/workflows-tokens lsm:issue/6740/localized-menus lsm:tests/nunit-azure lsm:issue/4569 lsm:sebros/cachegate lsm:sebros/filecache lsm:sebros/etag lsm:issue/snippets lsm:issue/infoset-nullable-enums lsm:feature/widgets lsm:lucene48 lsm:1.9.2 lsm:issue/5848/importexport lsm:task/masterlayouts lsm:feature/webpi lsm:issue/5791/homealias lsm:feature/sqlite lsm:feature/uniqueconstraints lsm:feature/tenantcommands lsm:feature/asynccache lsm:feature/gulp4all lsm:feature/deployment-backup lsm:feature/tenantreset lsm:feature/recipelogging lsm:feature/caching lsm:feature/backgroundtasks lsm:feature/livetranslations lsm:feature/nuget lsm:feature/asyncscripts lsm:feature/wrappers
lsm:1.11 lsm:1.10.4 lsm:1.10.3 lsm:1.10.2 lsm:1.10.1 lsm:1.10 lsm:1.9.3 lsm:1.9.2 lsm:1.9.1 lsm:1.0 lsm:1.1 lsm:1.2 lsm:1.3 lsm:1.4.2 lsm:1.5.1 lsm:1.6.1 lsm:1.7.3 lsm:1.8.2 lsm:1.0.3 lsm:1.0.2 lsm:1.0.1 lsm:1.0.0 lsm:patch-20150519 lsm:1.9 lsm:1.8.1 lsm:1.8 lsm:1.7.2 lsm:1.7.1 lsm:1.7 lsm:1.6 lsm:1.4.1 lsm:1.4 lsm:dev-old
...
compare: lsm:1.4.2
Branches Tags
lsm:dev lsm:BenedekFarkas/recycle-bin-improvements lsm:issue/8888 lsm:issue/8268 lsm:BenedekFarkas/fix-user-publish-button lsm:issue/8884 lsm:issue/8879 lsm:issue/8881 lsm:issue/8878 lsm:issue/8479 lsm:issue/8208 lsm:issue/8859 lsm:issue/7412 lsm:task/nuget-updates lsm:issue/8525 lsm:issue/8759 lsm:1.10.x-to-dev lsm:1.10.x lsm:issue/8850 lsm:issue/8830 lsm:BenedekFarkas/release-package-workflow lsm:BenedekFarkas/index-name-validation lsm:BenedekFarkas/windows-2025-runners-1.10.x lsm:BenedekFarkas/fix-gulp-pipeline-install lsm:issue/8822 lsm:issue/8800 lsm:issue/8232 lsm:issue/8819 lsm:issue/6992 lsm:issue/8276 lsm:issue/8816 lsm:issue/8814 lsm:issue/8811 lsm:issue/8752 lsm:issue/8808 lsm:issue/8791 lsm:issue/6193/htmlfilter lsm:issue/6748 lsm:issue/8786 lsm:issue/8773 lsm:issue/8225 lsm:issue/8773-1.10.x lsm:issue/8776 lsm:issue/8686-dev lsm:issue/8684 lsm:issue/8710 lsm:issue/8686 lsm:MatteoPiovanelli-Laser-patch-1 lsm:issue/8642 lsm:Prevent-caching-GetTaxonomy-Action lsm:revert-8410-fix/8392_RemeberMeModelStateException lsm:issue/7713 lsm:autoroute-concurrency lsm:fileformatter lsm:feature/admin-theme lsm:issues/7747/recaptcha lsm:master lsm:1.10.2 lsm:issue/7467 lsm:blogpermissions lsm:issue/6991/owin-workcontextscope lsm:azureauth lsm:feature/deployments lsm:feature/canopy lsm:feature/6838/workflows-tokens lsm:issue/6740/localized-menus lsm:tests/nunit-azure lsm:issue/4569 lsm:sebros/cachegate lsm:sebros/filecache lsm:sebros/etag lsm:issue/snippets lsm:issue/infoset-nullable-enums lsm:feature/widgets lsm:lucene48 lsm:1.9.2 lsm:issue/5848/importexport lsm:task/masterlayouts lsm:feature/webpi lsm:issue/5791/homealias lsm:feature/sqlite lsm:feature/uniqueconstraints lsm:feature/tenantcommands lsm:feature/asynccache lsm:feature/gulp4all lsm:feature/deployment-backup lsm:feature/tenantreset lsm:feature/recipelogging lsm:feature/caching lsm:feature/backgroundtasks lsm:feature/livetranslations lsm:feature/nuget lsm:feature/asyncscripts lsm:feature/wrappers
lsm:1.11 lsm:1.10.4 lsm:1.10.3 lsm:1.10.2 lsm:1.10.1 lsm:1.10 lsm:1.9.3 lsm:1.9.2 lsm:1.9.1 lsm:1.0 lsm:1.1 lsm:1.2 lsm:1.3 lsm:1.4.2 lsm:1.5.1 lsm:1.6.1 lsm:1.7.3 lsm:1.8.2 lsm:1.0.3 lsm:1.0.2 lsm:1.0.1 lsm:1.0.0 lsm:patch-20150519 lsm:1.9 lsm:1.8.1 lsm:1.8 lsm:1.7.2 lsm:1.7.1 lsm:1.7 lsm:1.6 lsm:1.4.1 lsm:1.4 lsm:dev-old

1 Commits
feature/as ... 1.4.2

Author SHA1 Message Date
Sebastien Ros
b96882ee3b Applying security fix 
http://docs.orchardproject.net/Documentation/Patch-20150519
 2015-06-30 11:22:30 -07:00
2 changed files with 10 additions and 5 deletions
Expand all files Collapse all files

9
src/Orchard.Web/Modules/Orchard.Users/Controllers/AdminController.cs
View File

@@ -291,6 +291,7 @@ namespace Orchard.Users.Controllers {
return RedirectToAction("Index"); return RedirectToAction("Index");
} }
[HttpPost]
public ActionResult SendChallengeEmail(int id) { public ActionResult SendChallengeEmail(int id) {
if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users"))) if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
return new HttpUnauthorizedResult(); return new HttpUnauthorizedResult();
@@ -311,7 +312,9 @@ namespace Orchard.Users.Controllers {
return RedirectToAction("Index"); return RedirectToAction("Index");
} }
public ActionResult Approve(int id) { [HttpPost]
public ActionResult Approve(int id)
{
if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users"))) if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
return new HttpUnauthorizedResult(); return new HttpUnauthorizedResult();
@@ -328,7 +331,9 @@ namespace Orchard.Users.Controllers {
return RedirectToAction("Index"); return RedirectToAction("Index");
} }
public ActionResult Moderate(int id) { [HttpPost]
public ActionResult Moderate(int id)
{
if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users"))) if (!Services.Authorizer.Authorize(StandardPermissions.SiteOwner, T("Not authorized to manage users")))
return new HttpUnauthorizedResult(); return new HttpUnauthorizedResult();

6
src/Orchard.Web/Modules/Orchard.Users/Views/Admin/Index.cshtml
View File

@@ -71,12 +71,12 @@
@Html.ActionLink(T("Edit").ToString(), "Edit", new { entry.User.Id }) | @Html.ActionLink(T("Edit").ToString(), "Edit", new { entry.User.Id }) |
@Html.ActionLink(T("Delete").ToString(), "Delete", new { entry.User.Id}, new { itemprop = "RemoveUrl UnsafeUrl" }) | @Html.ActionLink(T("Delete").ToString(), "Delete", new { entry.User.Id}, new { itemprop = "RemoveUrl UnsafeUrl" }) |
@if (entry.User.RegistrationStatus == UserStatus.Pending) { @if (entry.User.RegistrationStatus == UserStatus.Pending) {
@Html.ActionLink(T("Approve").ToString(), "Approve", new { entry.User.Id }) @Html.ActionLink(T("Approve").ToString(), "Approve", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
} else { } else {
@Html.ActionLink(T("Disable").ToString(), "Moderate", new { entry.User.Id }) @Html.ActionLink(T("Disable").ToString(), "Moderate", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
} }
@if (entry.User.EmailStatus == UserStatus.Pending) { <text>|</text> @if (entry.User.EmailStatus == UserStatus.Pending) { <text>|</text>
@Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { entry.User.Id }) @Html.ActionLink(T("Send challenge E-mail").ToString(), "SendChallengeEmail", new { entry.User.Id }, new { itemprop = "UnsafeUrl" })
} }
</td> </td>
</tr> </tr>