Merge branch 'master' into master

Author: farzindev

.gitignore

@@ -186,3 +186,5 @@ BlogEngine/.vs/
 
 # Default extensions data
 BlogEngine/BlogEngine.NET/App_Data/datastore/extensions/*.xml
+/.vs/slnx.sqlite
+/.vs/BlogEngine.NET/config/applicationhost.config

BlogEngine/BlogEngine.Core/API/MetaWeblog/XMLRPCRequest.cs

@@ -327,7 +327,7 @@ private static MWAPost GetPost(XmlNode node)
         /// </param>
         private void LoadXmlRequest(string xml)
         {
-            var request = new XmlDocument();
+            var request = new XmlDocument() { XmlResolver = null };
             try
             {
                 if (!(xml.StartsWith("<?xml") || xml.StartsWith("<method")))
@@ -505,4 +505,4 @@ private static string ParseRequest(HttpContext context)
 
         #endregion
     }
-}
+}

BlogEngine/BlogEngine.Core/BlogSettings.cs

@@ -420,27 +420,27 @@ public string Theme
                     var request = context.Request;
                     if (request.QueryString["theme"] != null)
                     {
-                        return request.QueryString["theme"];
+                        return request.QueryString["theme"].SanitizePath();
                     }
 
                     var cookie = request.Cookies[this.ThemeCookieName];
                     if (cookie != null)
                     {
-                        return cookie.Value;
+                        return cookie.Value.SanitizePath();
                     }
 
                     if (Utils.ShouldForceMainTheme(request))
                     {
-                        return this.configuredTheme;
+                        return this.configuredTheme.SanitizePath();
                     }
                 }
 
-                return this.configuredTheme;
+                return this.configuredTheme.SanitizePath();
             }
 
             set
             {
-                this.configuredTheme = String.IsNullOrEmpty(value) ? String.Empty : value;
+                this.configuredTheme = String.IsNullOrEmpty(value) ? String.Empty : value.SanitizePath();
             }
         }
 

BlogEngine/BlogEngine.Core/Data/FileManagerRepository.cs

@@ -18,6 +18,8 @@ public IEnumerable<FileInstance> Find(int take = 10, int skip = 0, string path =
             var rwr = Utils.RelativeWebRoot;
             var responsePath = "root";
 
+            path = path.SanitizePath();
+
             if(string.IsNullOrEmpty(path))
                 path = Blog.CurrentInstance.StorageLocation + Utils.FilesFolder;
 

BlogEngine/BlogEngine.Core/Data/Models/SelectOption.cs

@@ -14,6 +14,10 @@ public class SelectOption
         /// </summary>
         public string OptionValue { get; set; }
         /// <summary>
+        /// Option Summary
+        /// </summary>
+        public string OptionSummary { get; set; }
+        /// <summary>
         /// Is option selected
         /// </summary>
         public bool IsSelected { get; set; }

BlogEngine/BlogEngine.Core/Extensions.cs

@@ -92,5 +92,27 @@ public static bool TryParse<T>(this string theString, out T output)
 
             return success;
         }
+
+        /// <summary>
+        /// Sanitize path by removing invalid characters. Valid path should look similar to "path/to/sub/folder"
+        /// </summary>
+        /// <param name="str">String to sanitize</param>
+        /// <param name="root">Optionally validate datastore root</param>
+        /// <returns>String out</returns>
+        public static string SanitizePath(this string str, string root = "")
+        {
+            if (str.Contains(".."))
+                return "";
+
+            if (str.StartsWith("~/") && !string.IsNullOrEmpty(root) && !str.StartsWith(root))
+                return "";
+
+            str = str.Replace(".", "").Replace("\\", "").Replace("%2F", "");
+
+            if (str.Contains("//"))
+                return "";
+
+            return str;
+        }
     }
 }

BlogEngine/BlogEngine.Core/Properties/AssemblyInfo.cs

@@ -13,11 +13,11 @@
 [assembly: AssemblyConfiguration("")]
 [assembly: AssemblyCompany("")]
 [assembly: AssemblyProduct("BlogEngine.NET")]
-[assembly: AssemblyCopyright("Copyright @ 2007-2017")]
+[assembly: AssemblyCopyright("Copyright @ 2007-2019")]
 [assembly: AssemblyTrademark("")]
 [assembly: AssemblyCulture("")]
 [assembly: CLSCompliant(false)]
 [assembly: ComVisible(false)]
 [assembly: AllowPartiallyTrustedCallers]
-[assembly: AssemblyVersion("3.3.6.0")]
-[assembly: SecurityRules(SecurityRuleSet.Level1)]
+[assembly: AssemblyVersion("3.3.8.0")]
+[assembly: SecurityRules(SecurityRuleSet.Level1)]

BlogEngine/BlogEngine.Core/Services/Security/Security.cs

@@ -185,10 +185,7 @@ public static bool AuthenticateUser(string username, string password, bool remem
                     string returnUrl = context.Request.QueryString["returnUrl"];
 
                     // ignore Return URLs not beginning with a forward slash, such as remote sites.
-                    if (string.IsNullOrWhiteSpace(returnUrl) || !returnUrl.StartsWith("/"))
-                        returnUrl = null;
-
-                    if (!string.IsNullOrWhiteSpace(returnUrl))
+                    if (Security.IsLocalUrl(returnUrl))
                     {
                         context.Response.Redirect(returnUrl);
                     }
@@ -204,6 +201,19 @@ public static bool AuthenticateUser(string username, string password, bool remem
             return false;
         }
 
+        private static bool IsLocalUrl(string url)
+        {
+            if (string.IsNullOrWhiteSpace(url))
+            {
+                return false;
+            }
+            else
+            {
+                return ((url[0] == '/' && (url.Length == 1 || (url[1] != '/' && url[1] != '\\'))) || // "/" or "/foo" but not "//" or "/\" 
+						(url.Length > 1 && url[0] == '~' && url[1] == '/')); // "~/" or "~/foo"
+            }
+        }
+
         private const string AUTH_TKT_USERDATA_DELIMITER = "-|-";
 
         private static string SecurityValidationKey

BlogEngine/BlogEngine.Core/Services/Syndication/SyndicationGenerator.cs

@@ -35,7 +35,7 @@ public class SyndicationGenerator
         /// <summary>
         ///     Private member to hold the URI of the syndication generation utility.
         /// </summary>
-        private static readonly Uri GeneratorUri = new Uri("http://dotnetblogengine.net/");
+        private static readonly Uri GeneratorUri = new Uri("https://blogengine.io/");
 
         /// <summary>
         ///     Private member to hold the version of the syndication generation utility.
@@ -135,7 +135,7 @@ public static Dictionary<string, string> SupportedNamespaces
                                 { "wfw", "http://wellformedweb.org/CommentAPI/" },
                                 { "slash", "http://purl.org/rss/1.0/modules/slash/" },
                                 { "geo", "http://www.w3.org/2003/01/geo/wgs84_pos#" },
-                                { "betag", "http://dotnetblogengine.net/schemas/tags"}
+                                { "betag", "https://blogengine.io/schemas/tags"}
                             });
             }
         }
@@ -536,7 +536,7 @@ private static void WriteAtomEntry(XmlWriter writer, IPublishable publishable)
             {
                 foreach (var tag in publishable.Tags)
                 {
-                    writer.WriteElementString("betag", "tag", "http://dotnetblogengine.net/schemas/tags", tag);
+                    writer.WriteElementString("betag", "tag", "https://blogengine.io/schemas/tags", tag);
                 }
             }
 
@@ -725,7 +725,7 @@ private static void WriteRssItem(XmlWriter writer, IPublishable publishable)
             {
                 foreach (var tag in publishable.Tags)
                 {
-                    writer.WriteElementString("betag", "tag", "http://dotnetblogengine.net/schemas/tags", tag);
+                    writer.WriteElementString("betag", "tag", "https://blogengine.io/schemas/tags", tag);
                 }
             }
 

BlogEngine/BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs

@@ -337,7 +337,7 @@ private static XmlDocument RetrieveXmlDocument(HttpContext context)
                 context.Response.End();
             }
 
-            var doc = new XmlDocument();
+            var doc = new XmlDocument() { XmlResolver = null };
             doc.LoadXml(xml);
             return doc;
         }
@@ -432,4 +432,4 @@ private void ExamineSourcePage(string sourceUrl, string targetUrl)
 
         #endregion
     }
-}
+}