FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Updates release with fixes incorrectly merged into develop by valadas · Pull Request #98 · DNNCommunity/DNN.Repository · GitHub

/ DNN.Repository Public

Updates release with fixes incorrectly merged into develop #98

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
valadas merged 4 commits into from
May 30, 2026
Conversation 0 Commits 4 Checks 1 Files changed
Merged

Updates release with fixes incorrectly merged into develop #98

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d50293e
Merge pull request #96 from DNNCommunity/release/4.2.0
valadas May 22, 2026
928bd1b
Fixed an html encoding issue
valadas May 30, 2026
5e6a1c1
Additional replacements of PortalSecurityUsages
valadas May 30, 2026
2712664
Merge pull request #97 from valadas/sanitize-encode
valadas May 30, 2026
File filter

Filter by extension

Filter by extension .cs  (4) All 1 file type selected
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
14 changes: 7 additions & 7 deletions Helpers.cs
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -860,11 +860,11 @@ public void AddCategoryToTreeObject(int moduleid, int itemid, ArrayList arr, Dot
DotNetNuke.UI.WebControls.TreeNode newNode = new DotNetNuke.UI.WebControls.TreeNode();
if (showCount)
{
newNode.Text = cat.Category + "(" + cat.Count.ToString() + ")";
newNode.Text = WebUtility.HtmlEncode(cat.Category) + "(" + cat.Count.ToString() + ")";
}
else
{
newNode.Text = cat.Category;
newNode.Text = WebUtility.HtmlEncode(cat.Category);
}
newNode.Key = cat.ItemId.ToString();
newNode.ToolTip = "";
Expand Down Expand Up @@ -1494,11 +1494,11 @@ private void AddFile(int ModuleID, string strFileNamePath, string strExtension,
// ------------------------------------------------------------------

objRepository.ItemId = pRepository.ItemId;
objRepository.Name = WebUtility.HtmlEncode(pRepository.Name);
objRepository.Description = objSecurity.InputFilter(pRepository.Description, PortalSecurity.FilterFlag.NoScripting);
objRepository.Summary = objSecurity.InputFilter(pRepository.Summary, PortalSecurity.FilterFlag.NoScripting);
objRepository.Author = WebUtility.HtmlEncode(pRepository.Author);
objRepository.AuthorEMail = WebUtility.HtmlEncode(pRepository.AuthorEMail);
objRepository.Name = HtmlUtils.StripTags(pRepository.Name, false);
objRepository.Description = HtmlUtils.SanitizeHtmlIfNeeded(System.Web.HttpUtility.HtmlDecode(pRepository.Description), false);
objRepository.Summary = HtmlUtils.SanitizeHtmlIfNeeded(System.Web.HttpUtility.HtmlDecode(pRepository.Summary), false);
objRepository.Author = HtmlUtils.StripTags(pRepository.Author, false);
objRepository.AuthorEMail = HtmlUtils.StripTags(pRepository.AuthorEMail, false);
objRepository.CreatedByUser = userInfo.UserID.ToString();
objRepository.ModuleId = _ModuleID;
objRepository.PreviewImage = "";
Expand Down
25 changes: 9 additions & 16 deletions Repository.ascx.cs
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -527,7 +527,6 @@ private void SendCommentNotification(RepositoryInfo objRepository, TextBox txtNa

public void lstObjects_ItemCommand(object source, DataGridCommandEventArgs e)
{
DotNetNuke.Security.PortalSecurity objSecurity = new DotNetNuke.Security.PortalSecurity();
PlaceHolder objPlaceHolder = (PlaceHolder)e.Item.Cells[0].FindControl("PlaceHolder");
HtmlTable objCommentTable = (HtmlTable)e.Item.Cells[0].FindControl("tblComments");

Expand Down Expand Up @@ -619,11 +618,9 @@ public void lstObjects_ItemCommand(object source, DataGridCommandEventArgs e)
objCommentsPanel = (Panel)e.Item.Cells[0].FindControl("pnlComments");
txtName = (TextBox)objCommentsPanel.FindControl("txtUserName");
txtComment = (TextBox)objCommentsPanel.FindControl("txtComment");
txtName.Text = WebUtility.HtmlEncode(txtName.Text);
txtComment.Text = WebUtility.HtmlEncode(txtComment.Text);
if (txtName.Text.Length > 0 & txtComment.Text.Length > 0)
{
repositoryComments.AddRepositoryComment(objRepository.ItemId, ModuleId, txtName.Text, txtComment.Text);
repositoryComments.AddRepositoryComment(objRepository.ItemId, ModuleId, HtmlUtils.StripTags(txtName.Text, false), HtmlUtils.StripTags(txtComment.Text, false));
SendCommentNotification(objRepository, txtName, txtComment);
}
b_CommentsIsVisible = false;
Expand Down Expand Up @@ -787,7 +784,6 @@ private void lstObjects_ItemDataBound(object sender, DataGridItemEventArgs e)

private void DataList1_ItemCommand(object source, System.Web.UI.WebControls.DataListCommandEventArgs e)
{
DotNetNuke.Security.PortalSecurity objSecurity = new DotNetNuke.Security.PortalSecurity();
PlaceHolder objPlaceHolder = (PlaceHolder)e.Item.FindControl("PlaceHolder1");
HtmlTable objCommentTable = (HtmlTable)e.Item.FindControl("tblComments");

Expand Down Expand Up @@ -894,11 +890,9 @@ private void DataList1_ItemCommand(object source, System.Web.UI.WebControls.Data
objCommentsPanel = (Panel)objPlaceHolder.FindControl("pnlComments");
txtName = (TextBox)objCommentsPanel.FindControl("txtUserName");
txtComment = (TextBox)objCommentsPanel.FindControl("txtComment");
txtName.Text = WebUtility.HtmlEncode(txtName.Text);
txtComment.Text = WebUtility.HtmlEncode(txtComment.Text);
if (txtName.Text.Length > 0 & txtComment.Text.Length > 0)
{
repositoryComments.AddRepositoryComment(objRepository.ItemId, ModuleId, txtName.Text, txtComment.Text);
repositoryComments.AddRepositoryComment(objRepository.ItemId, ModuleId, HtmlUtils.StripTags(txtName.Text, false), HtmlUtils.StripTags(txtComment.Text, false));
SendCommentNotification(objRepository, txtName, txtComment);
}
System.Collections.Generic.List<RepositoryInfo> items = new System.Collections.Generic.List<RepositoryInfo>();
Expand Down Expand Up @@ -981,7 +975,6 @@ private void GenerateTemplateOutput(string[] pTemplate, object dataItem, PlaceHo
RepositoryAttributeValuesInfo value = null;
RepositoryObjectValuesController objectValues = new RepositoryObjectValuesController();
RepositoryObjectValuesInfo objectValue = null;
DotNetNuke.Security.PortalSecurity objSecurity = new DotNetNuke.Security.PortalSecurity();

objRepository = new RepositoryInfo();
objRepository = dataItem as RepositoryInfo;
Expand Down Expand Up @@ -1245,12 +1238,12 @@ private void GenerateTemplateOutput(string[] pTemplate, object dataItem, PlaceHo
}
if (bRaw)
{
objPlaceHolder.Controls.Add(new LiteralControl(sCat));
objPlaceHolder.Controls.Add(new LiteralControl(WebUtility.HtmlEncode(sCat)));
}
else
{
Label objCategoryLabel = new Label();
objCategoryLabel.Text = sCat;
objCategoryLabel.Text = WebUtility.HtmlEncode(sCat);
objCategoryLabel.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "CssClass", "Head");
objPlaceHolder.Controls.Add(objCategoryLabel);
}
Expand All @@ -1263,7 +1256,7 @@ private void GenerateTemplateOutput(string[] pTemplate, object dataItem, PlaceHo
foreach (RepositoryObjectCategoriesInfo item in categoryController.GetRepositoryObjectCategories(objRepository.ItemId))
{
objCategory = categories.GetSingleRepositoryCategory(item.CategoryID);
sCategories.Append(objCategory.Category + ",");
sCategories.Append(WebUtility.HtmlEncode(objCategory.Category) + ",");
}

if (bRaw)
Expand Down Expand Up @@ -1324,25 +1317,25 @@ private void GenerateTemplateOutput(string[] pTemplate, object dataItem, PlaceHo
case "DESCRIPTION":
if (bRaw)
{
objPlaceHolder.Controls.Add(new LiteralControl(objSecurity.InputFilter(Server.HtmlDecode(objRepository.Description), PortalSecurity.FilterFlag.NoScripting)));
objPlaceHolder.Controls.Add(new LiteralControl(HtmlUtils.SanitizeHtmlIfNeeded(objRepository.Description, false)));
}
else
{
Label objDescriptionLabel = new Label();
objDescriptionLabel.Text = objSecurity.InputFilter(Server.HtmlDecode(objRepository.Description), PortalSecurity.FilterFlag.NoScripting);
objDescriptionLabel.Text = HtmlUtils.SanitizeHtmlIfNeeded(objRepository.Description, false);
objDescriptionLabel.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "DESCRIPTION", "CssClass", "normal");
objPlaceHolder.Controls.Add(objDescriptionLabel);
}
break;
case "SUMMARY":
if (bRaw)
{
objPlaceHolder.Controls.Add(new LiteralControl(objSecurity.InputFilter(Server.HtmlDecode(objRepository.Summary), PortalSecurity.FilterFlag.NoScripting)));
objPlaceHolder.Controls.Add(new LiteralControl(HtmlUtils.SanitizeHtmlIfNeeded(objRepository.Summary, false)));
}
else
{
Label objSummaryLabel = new Label();
objSummaryLabel.Text = objSecurity.InputFilter(Server.HtmlDecode(objRepository.Summary), PortalSecurity.FilterFlag.NoScripting);
objSummaryLabel.Text = HtmlUtils.SanitizeHtmlIfNeeded(objRepository.Summary, false);
objSummaryLabel.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "SUMMARY", "CssClass", "normal");
objPlaceHolder.Controls.Add(objSummaryLabel);
}
Expand Down
17 changes: 9 additions & 8 deletions RepositoryDashboard.ascx.cs
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
using Microsoft.Extensions.DependencyInjection;
using System;
using System.Collections;
using System.Net;
//
// DotNetNuke® - http://www.dotnetnuke.com
// Copyright (c) 2002-2005
Expand Down Expand Up @@ -929,12 +930,12 @@ private void InjectAuthorToken(RepositoryInfo objItem)
// -- check the download roles
LinkButton objLinkButton = new LinkButton();
objLinkButton.ID = "hypDownload";
objLinkButton.Text = objItem.Author.ToString();
objLinkButton.Text = WebUtility.HtmlEncode(objItem.Author.ToString());
objLinkButton.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "AUTHOR", "CssClass", "SubHead");
objLinkButton.CommandName = "SelectAuthor";
objLinkButton.CommandArgument = objItem.Author.ToString();
objLinkButton.EnableViewState = true;
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + objItem.Author.ToString());
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + WebUtility.HtmlEncode(objItem.Author.ToString()));
objPlaceHolder.Controls.Add(objLinkButton);
}

Expand All @@ -946,7 +947,7 @@ private void InjectDownloadToken(RepositoryInfo objItem, bool isFileName)
LinkButton objLinkButton = new LinkButton();
objLinkButton.ID = "hypDownload";
if (isFileName) {
objLinkButton.Text = objItem.Name.ToString();
objLinkButton.Text = WebUtility.HtmlEncode(objItem.Name.ToString());
if (oRepositoryBusinessController.IsURL(objItem.FileName)) {
objLinkButton.ToolTip = Localization.GetString("ClickToDownload", LocalResourceFile);
} else {
Expand Down Expand Up @@ -978,14 +979,14 @@ private void InjectFilenameToken(RepositoryInfo objItem)
} else {
LinkButton objLinkButton = new LinkButton();
objLinkButton.ID = "hypDownload";
objLinkButton.Text = objItem.Name.ToString();
objLinkButton.Text = WebUtility.HtmlEncode(objItem.Name.ToString());
objLinkButton.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "FILENAME", "CssClass", "normal");
objLinkButton.EnableViewState = true;
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + objItem.Name.ToString());
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + WebUtility.HtmlEncode(objItem.Name.ToString()));
objLinkButton.CommandName = "SelectFile";
objLinkButton.CommandArgument = objItem.ItemId.ToString();
objLinkButton.EnableViewState = true;
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + objItem.Name.ToString());
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + WebUtility.HtmlEncode(objItem.Name.ToString()));
objPlaceHolder.Controls.Add(objLinkButton);
objLinkButton.ToolTip = Localization.GetString("ClickToVisit", LocalResourceFile);
objLinkButton.EnableViewState = true;
Expand Down Expand Up @@ -1053,12 +1054,12 @@ private void InjectCategoryToken(RepositoryCategoryInfo objCategory)
if (!string.IsNullOrEmpty(objCategory.Category)) {
LinkButton objLinkButton = new LinkButton();
objLinkButton.ID = "hypDownload";
objLinkButton.Text = objCategory.Category.ToString();
objLinkButton.Text = WebUtility.HtmlEncode(objCategory.Category.ToString());
objLinkButton.CssClass = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "CssClass", "SubHead");
objLinkButton.CommandName = "SelectCategory";
objLinkButton.CommandArgument = objCategory.ItemId.ToString();
objLinkButton.EnableViewState = true;
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + " " + objCategory.Category.ToString());
objLinkButton.ToolTip = oRepositoryBusinessController.GetSkinAttribute(xmlDoc, "CATEGORY", "ToolTip", Localization.GetString("ClickToView", LocalResourceFile) + " " + WebUtility.HtmlEncode(objCategory.Category.ToString()));
objPlaceHolder.Controls.Add(objLinkButton);
}
}
Expand Down
16 changes: 8 additions & 8 deletions Settings.ascx.cs
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
Expand Up @@ -1374,18 +1374,18 @@ private void lbAddCategory_Click(object sender, System.EventArgs e)
if (lbAddCategory.Text == Localization.GetString("SaveButton", LocalResourceFile))
{
category = categories.GetSingleRepositoryCategory(_key);
categories.UpdateRepositoryCategory(_key, WebUtility.HtmlEncode(txtNewCategory.Text.Trim()), _parent, category.ViewOrder);
lstCategories.Items[_index].Text = WebUtility.HtmlEncode(txtNewCategory.Text.Trim());
categories.UpdateRepositoryCategory(_key, HtmlUtils.StripTags(txtNewCategory.Text.Trim(), false), _parent, category.ViewOrder);
lstCategories.Items[_index].Text = HtmlUtils.StripTags(txtNewCategory.Text.Trim(), false);
txtNewCategory.Text = "";
lbAddCategory.Text = Localization.GetString("AddCategory", LocalResourceFile);
lbCancelCategory.Visible = false;
}
else
{
int dNewCatId = 0;
dNewCatId = categories.AddRepositoryCategory(-1, ModuleId, WebUtility.HtmlEncode(txtNewCategory.Text.Trim()), _parent, 99);
dNewCatId = categories.AddRepositoryCategory(-1, ModuleId, HtmlUtils.StripTags(txtNewCategory.Text.Trim(), false), _parent, 99);
ListItem objListItem = new ListItem();
objListItem.Text = WebUtility.HtmlEncode(txtNewCategory.Text.Trim());
objListItem.Text = HtmlUtils.StripTags(txtNewCategory.Text.Trim(), false);
objListItem.Value = dNewCatId.ToString();
lstCategories.Items.Add(objListItem);
txtNewCategory.Text = "";
Expand Down Expand Up @@ -1425,7 +1425,7 @@ private void lbAddAttribute_Click(object sender, System.EventArgs e)
if (lbAddAttribute.Text == Localization.GetString("SaveButton", LocalResourceFile))
{
attribute = attributes.GetSingleRepositoryAttributes(_key);
attribute.AttributeName = WebUtility.HtmlEncode(txtNewAttribute.Text.Trim());
attribute.AttributeName = HtmlUtils.StripTags(txtNewAttribute.Text.Trim(), false);
RepositoryAttributesController.UpdateRepositoryAttributes(attribute);
lstAttributes.Items[_index].Text = attribute.AttributeName;
txtNewAttribute.Text = "";
Expand All @@ -1436,7 +1436,7 @@ private void lbAddAttribute_Click(object sender, System.EventArgs e)
{
int dNewAttrId = 0;
attribute = new RepositoryAttributesInfo();
attribute.AttributeName = WebUtility.HtmlEncode(txtNewAttribute.Text.Trim());
attribute.AttributeName = HtmlUtils.StripTags(txtNewAttribute.Text.Trim(), false);
attribute.ModuleID = ModuleId;
dNewAttrId = attributes.AddRepositoryAttributes(attribute);
ListItem objListItem = new ListItem();
Expand Down Expand Up @@ -1469,7 +1469,7 @@ private void lbAddValue_Click(object sender, EventArgs e)
if (lbAddValue.Text == Localization.GetString("SaveButton", LocalResourceFile))
{
attributeValue = attributeValues.GetSingleRepositoryAttributeValues(_key);
attributeValue.ValueName = WebUtility.HtmlEncode(txtNewValue.Text.Trim());
attributeValue.ValueName = HtmlUtils.StripTags(txtNewValue.Text.Trim(), false);
RepositoryAttributeValuesController.UpdateRepositoryAttributeValues(attributeValue);
lstValues.Items[_index].Text = attributeValue.ValueName;
txtNewValue.Text = "";
Expand All @@ -1481,7 +1481,7 @@ private void lbAddValue_Click(object sender, EventArgs e)
int dNewAttrId = 0;
attributeValue = new RepositoryAttributeValuesInfo();
attributeValue.AttributeID = Convert.ToInt32(lstAttributes.SelectedValue);
attributeValue.ValueName = WebUtility.HtmlEncode(txtNewValue.Text.Trim());
attributeValue.ValueName = HtmlUtils.StripTags(txtNewValue.Text.Trim(), false);
dNewAttrId = attributeValues.AddRepositoryAttributeValues(attributeValue);
ListItem objListItem = new ListItem();
objListItem.Text = attributeValue.ValueName;
Expand Down
Back | FazBrowse Home | New Git URL