Anyone, how to set HttpOnly and Secure flag of "lang" Sitecore cookie?
I've tried to set via processor pipeline as the following code
public class CookiesFlagResolver : HttpRequestProcessor
{
public override void Process(HttpRequestArgs args)
{
HttpContext current = HttpContext.Current;
if (current != null)
{
SiteContext context = Context.Site;
string cookieKey = context.GetCookieKey("lang");
HttpCookie cookie = current.Request.Cookies[cookieKey];
if (cookie != null)
{
if (cookie.HttpOnly == false || cookie.Secure == false)
{
cookie.HttpOnly = true;
cookie.Secure = true;
current.Response.AppendCookie(cookie);
}
}
}
}
}
Patch configuration
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
<sitecore role:require="Standalone or ContentDelivery or ContentManagement">
<pipelines>
<httpRequestBegin>
<processor type="Website.Custom.Pipelines.CookiesFlagResolver, Website" patch:before="processor[#type='Sitecore.Pipelines.HttpRequest.LanguageResolver, Sitecore.Kernel']"/>
</httpRequestBegin>
</pipelines>
</sitecore>
</configuration>
I have checked that the code is being hit correctly when i debug it.
Unfortunately the "lang" cookie in browser still disabled.
Related
I seem to be stuck at developing a custom Key/Value pair provider for Amazon's System Manager Parameter Store (SSM) using NETFramework 4.7.1 that utilizes Microsoft.Configuration.ConfigurationBuilders.
The implementation:
using System;
using System.Collections.Generic;
using Amazon.SimpleSystemsManagement;
using Amazon.SimpleSystemsManagement.Model;
using Microsoft.Configuration.ConfigurationBuilders;
using System.Linq;
using System.Diagnostics;
using System.Collections.Specialized;
using Amazon.Runtime;
using Amazon.Runtime.CredentialManagement;
using System.Configuration;
using System.Threading.Tasks;
namespace AXS.Configurations
{
public class ParameterStoreConfigBuilder : KeyValueConfigBuilder
{
public const string envTag = "Environment";
public const string appNameTag = "AppName";
private IAmazonSimpleSystemsManagement client;
/// <summary>
/// Gets or sets an environment (dev|qa|staging|production)
/// </summary>
public string Environment { get; set; }
/// <summary>
/// Gets or sets a AppName
/// </summary>
public string AppName { get; set; }
public ParameterStoreConfigBuilder(IAmazonSimpleSystemsManagement client,
string appName,
string environment)
{
this.client = client;
Environment = environment.ToLower();
AppName = appName;
}
public ParameterStoreConfigBuilder()
{
client = new AmazonSimpleSystemsManagementClient();
}
public override string Description => "Parameter Store";
public override string Name => "SSM";
protected override void LazyInitialize(string name, NameValueCollection config)
{
Optional = false;
base.LazyInitialize(name, config);
string env = UpdateConfigSettingWithAppSettings(envTag);
if (string.IsNullOrWhiteSpace(env))
throw new ArgumentException($"environment must be specified with the '{envTag}' attribute.");
Environment = env;
string appName = UpdateConfigSettingWithAppSettings(appNameTag);
if (string.IsNullOrWhiteSpace(appName))
throw new ArgumentException($"appName must be specified with the '{appNameTag}' attribute.");
AppName = appName;
client = new AmazonSimpleSystemsManagementClient("","", Amazon.RegionEndpoint.USWest2);
}
public override ICollection<KeyValuePair<string, string>> GetAllValues(string prefix)
{
Trace.TraceInformation($"return values prefix {prefix}");
if (client == null)
return null;
var parameters = new List<Parameter>();
string nextToken = null;
do
{
var response = client.GetParametersByPath(new GetParametersByPathRequest { Path = prefix, Recursive = true, WithDecryption = true, NextToken = nextToken });
nextToken = response.NextToken;
parameters.AddRange(response.Parameters);
} while (!string.IsNullOrEmpty(nextToken));
return parameters.Select(p => new
{
Key = p.Name,
p.Value
}).ToDictionary(parameter => parameter.Key, parameter => parameter.Value, StringComparer.OrdinalIgnoreCase);
}
public override string GetValue(string key)
{
return Task.Run(async () => { return await GetValueAsync(key); }).Result;
}
private async Task<string> GetValueAsync(string key)
{
var name = $"/{Environment}/{AppName}/{key.Replace(':', '/')}";
Trace.WriteLine($"get value async:{name}");
if (client == null)
return null;
try
{
Trace.TraceInformation($"fetch key {name}");
var request = new GetParameterRequest
{
Name = name,
WithDecryption = true
};
var response = await client.GetParameterAsync(request);
var parameter = response.Parameter;
var value = parameter.Type == ParameterType.SecureString ? "*****" : parameter.Value;
Trace.TraceInformation($"fetched name={name} value={value}");
return value;
}
catch (Exception e) when (Optional && ((e.InnerException is System.Net.Http.HttpRequestException) || (e.InnerException is UnauthorizedAccessException))) { }
return null;
}
}
}
The problem seems to be that AWS SSM client never gets created.
If I change the code and try to instantiate in the constructor I get a stack overflow exception due to recursion.
Any ideas on how to force to get AmazonSimpleSystemsManagementClient created?
The code uses guidance from https://github.com/aspnet/MicrosoftConfigurationBuilders
The App.Config
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<configSections>
<section name="configBuilders" type="System.Configuration.ConfigurationBuildersSection,
System.Configuration, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a"
restartOnExternalChanges="false"
requirePermission="true" />
</configSections>
<configBuilders>
<builders>
<add name="ParameterStore" Environment="development" AppName="myAppNameforParmStore" type="AXS.Configurations.ParameterStoreConfigBuilder, AXS.Configurations" />
<add name="Env" prefix="appsettings_" stripPrefix="true" type="Microsoft.Configuration.ConfigurationBuilders.EnvironmentConfigBuilder, Microsoft.Configuration.ConfigurationBuilders.Environment, Version=2.0.0.0, Culture=neutral" />
</builders>
</configBuilders>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.1" />
</startup>
<appSettings configBuilders="Env,ParameterStore">
<add key="Url" value="URL Value for from paramter Store" />
<add key="Secret" value="Some Secret value decrypted" />
</appSettings>
</configuration>
Thanks
UPDATE
I posted an updated version of the AwsSsmConfigurationBuilder, and a sample ASP.NET Web Forms project that uses it, on my GitHub:
https://github.com/Kirkaiya/AwsSsmConfigBuilderPoC/
Disclaimer: This is a proof-of-concept (POC) for a custom ConfigurationBuilder for ASP.NET 4.7.1 or higher (running on .NET Framework obviously). It's a POC, so it doesn't do anything besides allow you store Configuration AppSettings in AWS Parameter Store (a feature of Simple Systems Manager). So, clearly, don't use this in production without productizing and testing it!
Prerequisites:
Your project must target .NET Framework 4.7.1 or higher
Include NuGet package Microsoft.Configuration.ConfigurationBuilders.Base
Have parameters in AWS SSM Parameter Store that have the same name (not counting the prefix) as parameters in your web.config file, and vice-versa.
Notes
In order to avoid recursively calling a concrete constructor or Initialize, I used a static constructor to instantiate the AmazonSimpleSystemsManagementClient, which is held in a static member.
Web.Config additions
Note: change the assembly/class-name of your builder to match yours, etc.
<configSections>
<section name="configBuilders" type="System.Configuration.ConfigurationBuildersSection, System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" restartOnExternalChanges="false" requirePermission="false" />
</configSections>
<configBuilders>
<builders>
<add name="ParameterStore" ssmPrefix="/padnugapp/ApiKeys" type="Microsoft.Configuration.ConfigurationBuilders.AwsSsmConfigBuilder, AspNetWebFormsSample" />
</builders>
</configBuilders>
<appSettings configBuilders="ParameterStore">
<add key="TestKey" value="TestKey Value from web.config" />
<add key="TwitterKey" value="TwitterKey value from web.config" />
</appSettings>
And the AwsSsmConfigBuilder.cs file:
namespace Microsoft.Configuration.ConfigurationBuilders
{
public class AwsSsmConfigBuilder : KeyValueConfigBuilder
{
private string BaseParameterPath = "/padnugapp/ApiKeys";
private static IAmazonSimpleSystemsManagement _client;
static AwsSsmConfigBuilder()
{
_client = new AmazonSimpleSystemsManagementClient();
}
public override void Initialize(string name, NameValueCollection config)
{
base.Initialize(name, config);
if (config["ssmPrefix"] == null)
return;
BaseParameterPath = config["ssmPrefix"];
}
public override ICollection<KeyValuePair<string, string>> GetAllValues(string prefix)
{
if (_client == null)
return null;
var request = new GetParametersByPathRequest
{
Path = $"{BaseParameterPath}/{prefix}",
WithDecryption = true,
};
var response = _client.GetParametersByPathAsync(request).Result;
var result = response.Parameters.ToDictionary(param => param.Name, param => param.Value, StringComparer.OrdinalIgnoreCase);
return result;
}
public override string GetValue(string key)
{
if (_client == null)
return null;
var request = new GetParameterRequest
{
Name = $"{BaseParameterPath}/{key}",
WithDecryption = true,
};
var response = _client.GetParameterAsync(request).Result;
return response.Parameter.Value;
}
}
}
The code I put into a web-forms (.aspx) page that renders the two appSettings items in HTML:
TestKey =
<%=(System.Configuration.ConfigurationManager.AppSettings["TestKey"]) %>
<br />
TwitterKey =
<%=(System.Configuration.ConfigurationManager.AppSettings["TwitterKey"]) %>
I can't stress enough that this is just for a demo I'm doing, and not tested in any way, shape or form except on my laptop ;-)
I have two publishing target - one is stage and one is production.The publishing on Production should adhere to the publishing restrictions, but publishing on Stage should not look at or discard the valid to and valid from dates and publish under any circumstance.
I have written a publishing pipeline (PipelinePublishProvider). I am not sure how could I manage to overwrite the field values temporarily so it publishes on to stage every-time.
public class StagePublishOverride : PipelinePublishProvider
{
public override PublishHelper CreatePublishHelper(PublishOptions options)
{
Assert.ArgumentNotNull(options, "options");
if (options.TargetDatabase.Name.ToLower() == "stage")
{
Item itemToBePublished = new Item(options.RootItem.ID, options.RootItem.InnerData, new Database("web"));
itemToBePublished.Editing.BeginEdit();
itemToBePublished.Publishing.ValidTo = DateTime.MaxValue;
itemToBePublished.Publishing.ValidFrom = DateTime.MinValue;
itemToBePublished.Editing.EndEdit();
options.RootItem = itemToBePublished;
}
if (options is ExtendedPublishOptions)
return new ExtendedPublishHelper(options as ExtendedPublishOptions);
return new PublishHelper(options);
}
}
public class ExtendedPublishHelper : PublishHelper
{
private readonly ExtendedPublishOptions _options;
public ExtendedPublishHelper(ExtendedPublishOptions options)
: base(options)
{
_options = options;
}
public override Item GetVersionToPublish(Item sourceItem)
{
Assert.ArgumentNotNull(sourceItem, "sourceItem");
if (Options is ExtendedPublishOptions)
{
return sourceItem.Publishing.GetValidVersion(Options.PublishDate, _options.RequireApproval);
}
return sourceItem.Publishing.GetValidVersion(Options.PublishDate, true);
}
}
public class ExtendedPublishOptions : PublishOptions
{
public ExtendedPublishOptions(Database sourceDatabase, Database targetDatabase, PublishMode mode, Language language, DateTime publishDate, bool requireApproval)
: base(sourceDatabase, targetDatabase, mode, language, publishDate)
{
RequireApproval = requireApproval;
}
public bool RequireApproval { get; set; }
}
}
I believe you'll be better off adding a processor to the publishItem pipeline. Here is some UNTESTED code, which I think will serve your purpose:
public class PublishOverride : PublishItemProcessor
{
public override void Process(PublishItemContext context)
{
Assert.ArgumentNotNull((object)context, "context");
if (context.Action != PublishAction.None)
return;
Item sourceItem = this.GetSourceItem(context);
if (sourceItem == null)
return;
var stagingDB = Factory.GetDatabase("Stage");
if (stagingDB != null && !sourceItem.Publishing.NeverPublish && context.PublishContext.PublishOptions.TargetDatabase == stagingDB)
{
context.Action = PublishAction.PublishVersion;
context.VersionToPublish = sourceItem;
}
}
private Item GetSourceItem(PublishItemContext context)
{
Assert.ArgumentNotNull((object)context, "context");
return context.PublishHelper.GetSourceItem(context.ItemId);
}
}
Make sure you patch it in before the DetermineAction processor in the default config. So your config patch would look like this:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:x="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<publishItem>
<processor patch:before="*[#type='Sitecore.Publishing.Pipelines.PublishItem.DetermineAction, Sitecore.Kernel']"
type="YourNamespace.PublishOverride, YourAssembly" />
</publishItem>
</pipelines>
</sitecore>
</configuration>
I want to hide quick info section through code instead of unchecking the check box in Application Options dialog box. Can someone help in this?
The following code does exactly what your looking for.
Add this code below:
namespace Custom.Framework.SC.Extensions.Pipelines
{
using Sitecore.Pipelines.LoggedIn;
using SC = Sitecore;
/// <summary>The default quick info.</summary>
public class DefaultQuickInfo : SC.Pipelines.LoggedIn.LoggedInProcessor
{
/// <summary>The process.</summary>
/// <param name="args">The args.</param>
public override void Process(LoggedInArgs args)
{
const string DefaultToVisible = "false";
SC.Diagnostics.Assert.ArgumentNotNull(args, "args");
SC.Diagnostics.Assert.IsTrue(
SC.Security.Accounts.User.Exists(args.Username),
args.Username);
var user = SC.Security.Accounts.User.FromName(
args.Username,
true);
SC.Diagnostics.Assert.IsNotNull(user, "user");
var sitecoreDomain = SC.SecurityModel.DomainManager.GetDomain(
"sitecore");
SC.Diagnostics.Assert.IsNotNull(sitecoreDomain, "sitecoreDomain");
if (user.Domain != sitecoreDomain
|| user.Name.ToLower().EndsWith("\\" + sitecoreDomain.AnonymousUserName))
{
SC.Diagnostics.Log.Warn(this + " : unexpected security domain or user : " + user.Name, this);
return;
}
var key = "/" + args.Username + "/UserOptions.ContentEditor.ShowQuickInfo";
if (string.IsNullOrEmpty(user.Profile[key]))
{
user.Profile[key] = DefaultToVisible;
user.Profile.Save();
}
}
}
}
Then patch in this configuration change to add the processor to the appropriate place:
<?xml version="1.0" encoding="utf-8" ?>
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<processors>
<loggedin>
<processor patch:after="processor[position()=last()]" type="Custom.Framework.SC.Extensions.Pipelines.DefaultQuickInfo, Custom.Framework.SC.Extensions" />
</loggedin>
</processors>
</sitecore>
</configuration>
I need to get the rendered HTML output from a given Sitecore item, assuming it has a layout. I need it to be the latest version of the rendered content whether it's published or not. Using a web request approach like WebClient or HtmlAgility pack will not work because they make the request as an anonymous user which will only render the latest published version (and I need the latest version no matter the state.) Any thoughts? I have everything working I just cant find a way to impersonate or elevate the rights while I execute the page requests.
You could go the WebClient or HtmlAgility pack, but silently login the user based on a token in the query string:
public static class UserExtensions
{
public const string TokenKey = "UserToken";
public const string TokenDateKey = "UserTokenDate";
public static ID CreateUserToken(this User user)
{
if (user.IsAuthenticated)
{
var token = ID.NewID;
user.Profile.SetCustomProperty(TokenKey, token.ToString());
user.Profile.SetCustomProperty(TokenDateKey, DateTime.Now.ToString());
user.Profile.Save();
return token;
}
else
return ID.Null;
}
public static bool IsTokenValid(this User user, string token, TimeSpan maxAge)
{
var tokenId = ID.Null;
if (ID.TryParse(token, out tokenId))
{
var minDate = DateTime.Now.Add(-maxAge);
var tokenDateString = user.Profile.GetCustomProperty(TokenDateKey);
var tokenDate = DateTime.MinValue;
DateTime.TryParse(tokenDateString, out tokenDate);
if (tokenDate < minDate)
return false;
var storedToken = user.Profile.GetCustomProperty(TokenKey);
var storedTokenId = ID.NewID;
if (ID.TryParse(storedToken, out storedTokenId))
return storedTokenId == tokenId;
}
return false;
}
}
Then patch in a HttpRequestProcessor to look for the token:
public class SilentUserLogin : HttpRequestProcessor
{
public TimeSpan MaximumAge
{
get;
set;
}
public override void Process(HttpRequestArgs args)
{
var userValue = args.Context.Request.QueryString["user"];
var tokenValue = args.Context.Request.QueryString["token"];
if (!string.IsNullOrEmpty(userValue) && !string.IsNullOrEmpty(tokenValue))
{
// find user
var user = User.FromName(userValue, AccountType.User);
if (user != null)
{
// Check token is valid
if ((user as User).IsTokenValid(tokenValue, MaximumAge))
{
// log user in
AuthenticationManager.Login(user as User);
}
else
Log.Audit("User token has expired for user: '{0}'".FormatWith(user.Name), this);
}
else
Log.Audit("Failed to locate auto login user " + userValue, this);
}
}
Patch this in with a config file:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<httpRequestBegin>
<processor type="Namespace.SilentUserLogin,Assembly" patch:after="*[#type='Sitecore.Pipelines.HttpRequest.StartMeasurements, Sitecore.Kernel']">
<MaximumAge>00:02:00</MaximumAge>
</processor>
</httpRequestBegin>
</pipelines>
</sitecore>
</configuration>
Finally, call the page via WebClient or HtmlAgility:
var token = Sitecore.Context.User.CreateUserToken();
var url = new UrlString();
url.HostName = HttpContext.Current.Request.Url.Host;
url.Protocol = HttpContext.Current.Request.IsSecureConnection ? "https" : "http";
url.Path = "/";
url["sc_itemid"] = myItem.ID.ToString();
url["sc_lang"] = myItem.Language.ToString();
// Add parameters to allow accessing the master DB
url["user"] = Sitecore.Context.User.Name;
url["token"] = token.ToString();
// Call the url here
This code was cribbed from a similar situation where I needed a URL to feed to a PDF generation library, which behind the scenes fired up IE and hit the site as an anonymous user. This way we could pass a limited time security token via the query string.
You can setup a "preview" site that shows content from the master database as opposed to the public-facing published content. This article will help setting that up: How to Setup a Sitecore Preview Site to Review Content Before Publishing
Once you have this setup on a unique URL, you can then make a WebRequest to pages or use HtmlAgilityPack.
I understand that you can add new Notification for usage when cloning data items.
Where do you specify where you should use the custom Notification class?
We display a warning on items that have been cloned. The trick is to use the "getContentEditorWarnings" pipeline:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
<sitecore>
<pipelines>
<getContentEditorWarnings>
<processor type="Example.OriginalItem, Example" patch:after="processor[#type='Sitecore.Pipelines.GetContentEditorWarnings.Notifications, Sitecore.Kernel']" />
</getContentEditorWarnings>
</pipelines>
</sitecore>
</configuration>
Then the code for this pipeline is:
using Sitecore.Globalization;
using Sitecore.Pipelines.GetContentEditorWarnings;
namespace Example
{
public class OriginalItem
{
public void Process(GetContentEditorWarningsArgs args)
{
var item = args.Item;
if ((item == null) || item.GetClones().Count() == 0) return;
var warning = args.Add();
warning.Title = "This Item has clones";
warning.IsExclusive = false;
}
}
}
Not really germane to your question, but in this example, we use the links db to find if the item has clones:
public static IEnumerable<Item> GetClones(this Item original)
{
Assert.ArgumentNotNull(original, "source");
return (from link in Globals.LinkDatabase.GetReferrers(original)
select link.GetSourceItem() into clone
where ((clone != null) && (clone.Source != null)) && (clone.Source.ID == original.ID)
select clone);
}