use secure Packages location for upgrade process

Oqtane.Client/Modules/Admin/Upgrade/Index.razor

@@ -27,7 +27,7 @@
                         <Label HelpText="Upload a framework package and select Install to complete the installation" ResourceKey="Framework">Framework: </Label>
                     </td>
                     <td>
-                        <FileManager Filter="nupkg" ShowFiles="false" Folder="Framework" />
+                        <FileManager Filter="nupkg" ShowFiles="false" Folder="Packages" />
                     </td>
                 </tr>
             </table>
@@ -86,8 +86,9 @@
     {
         try
         {
-            await PackageService.DownloadPackageAsync(packageid, version, "Framework");
             ShowProgressIndicator();
+            await PackageService.DownloadPackageAsync(packageid, version, "Packages");
+            await PackageService.DownloadPackageAsync("Oqtane.Upgrade", version, "Packages");
             var interop = new Interop(JSRuntime);
             await interop.RedirectBrowser(NavigateUrl(), 10);
             await InstallationService.Upgrade();

Oqtane.Client/Services/InstallationService.cs

@@ -9,12 +9,7 @@ namespace Oqtane.Services
     [PrivateApi("Don't show in the documentation, as everything should use the Interface")]
     public class InstallationService : ServiceBase, IInstallationService
     {
-        private readonly SiteState _siteState;
+        public InstallationService(HttpClient http) : base(http) {}
-
-        public InstallationService(HttpClient http, SiteState siteState) : base(http)
-        {
-            _siteState = siteState;
-        }
 
         private string ApiUrl => CreateApiUrl("Installation", null); // tenant agnostic as SiteState does not exist
 

Oqtane.Package/Oqtane.Framework.nuspec

@@ -11,14 +11,12 @@
     <copyright>.NET Foundation</copyright>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <license type="expression">MIT</license>
-    <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
+    <projectUrl>https://github.com/oqtane/oqtane.framework/releases/download/v2.0.2/Oqtane.Framework.2.0.2.Upgrade.zip</projectUrl>
     <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v2.1.0</releaseNotes>
     <icon>icon.png</icon>
     <tags>oqtane framework</tags>
   </metadata>
   <files>
-    <file src="..\Oqtane.Server\bin\Release\net5.0\publish\*.*" target="lib\net5.0" /> 
-    <file src="..\Oqtane.Server\bin\Release\net5.0\publish\wwwroot\**\*.*" target="wwwroot" /> 
     <file src="icon.png" target="" />
   </files>
 </package>

Oqtane.Package/Oqtane.Upgrade.nuspec

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
+  <metadata>
+    <id>Oqtane.Upgrade</id>
+    <version>2.1.0</version>
+    <authors>Shaun Walker</authors>
+    <owners>.NET Foundation</owners>
+    <title>Oqtane Framework</title>
+    <summary>A modular application framework for Blazor</summary>
+    <description>A modular application framework for Blazor</description>
+    <copyright>.NET Foundation</copyright>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <license type="expression">MIT</license>
+    <projectUrl>https://github.com/oqtane/oqtane.framework</projectUrl>
+    <releaseNotes>https://github.com/oqtane/oqtane.framework/releases/tag/v2.1.0</releaseNotes>
+    <icon>icon.png</icon>
+    <tags>oqtane upgrade</tags>
+  </metadata>
+  <files>
+    <file src="..\Oqtane.Server\bin\Release\net5.0\Oqtane.Upgrade.*" target="lib\net5.0" /> 
+    <file src="icon.png" target="" />
+  </files>
+</package>

Oqtane.Package/release.cmd

@@ -5,6 +5,8 @@ copy /Y/B/V "..\Oqtane.Server\bin\Release\net5.0\System.Drawing.Common.dll" "..\
 nuget.exe pack Oqtane.Client.nuspec
 nuget.exe pack Oqtane.Server.nuspec
 nuget.exe pack Oqtane.Shared.nuspec                  
+nuget.exe pack Oqtane.Upgrade.nuspec
+nuget.exe pack Oqtane.Framework.nuspec
 del /F/Q/S "..\Oqtane.Server\bin\Release\net5.0\publish" > NUL
 rmdir /Q/S "..\Oqtane.Server\bin\Release\net5.0\publish"
 dotnet publish ..\Oqtane.Server\Oqtane.Server.csproj /p:Configuration=Release
@@ -12,8 +14,7 @@ del "..\Oqtane.Server\bin\Release\net5.0\publish\appsettings.json"
 ren "..\Oqtane.Server\bin\Release\net5.0\publish\appsettings.release.json" "appsettings.json"
 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ".\install.ps1"
 del "..\Oqtane.Server\bin\Release\net5.0\publish\appsettings.json"
-C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ".\upgrade.ps1"
 del "..\Oqtane.Server\bin\Release\net5.0\publish\Oqtane.Upgrade.*"
-nuget.exe pack Oqtane.Framework.nuspec
+C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe ".\upgrade.ps1"
 pause
 

Oqtane.Server/Controllers/FileController.cs

@@ -285,6 +285,7 @@ namespace Oqtane.Controllers
                 if (User.IsInRole(RoleNames.Host))
                 {
                     folderPath = GetFolderPath(folder);
+                    folderId = -1;
                 }
             }
 

Oqtane.Server/Infrastructure/InstallationManager.cs

@@ -4,6 +4,7 @@ using System.Diagnostics;
 using System.IO;
 using System.IO.Compression;
 using System.Linq;
+using System.Net;
 using System.Reflection;
 using System.Text.Json;
 using System.Text.RegularExpressions;
@@ -215,24 +216,22 @@ namespace Oqtane.Infrastructure
 
         public void UpgradeFramework()
         {
-            string folder = Path.Combine(_environment.WebRootPath, "Framework");
+            string folder = Path.Combine(_environment.ContentRootPath, "Packages");
             if (Directory.Exists(folder))
             {
-                // get package with highest version and clean up any others
+                // get package with highest version
                 string packagename = "";
-                foreach (string package in Directory.GetFiles(folder, "Oqtane.Framework.*.nupkg"))
+                string[] packages = Directory.GetFiles(folder, "Oqtane.Framework.*.nupkg");
+                if (packages.Length > 0)
                 {
-                    if (packagename != "")
+                    packagename = packages[packages.Length - 1]; // use highest version 
-                    {
-                        File.Delete(packagename);
-                    }
-                    packagename = package;
                 }
 
                 if (packagename != "")
                 {
                     // verify package version
                     string packageversion = "";
+                    string packageurl = "";
                     using (ZipArchive archive = ZipFile.OpenRead(packagename))
                     {
                         // locate nuspec
@@ -251,6 +250,11 @@ namespace Oqtane.Infrastructure
                                 {
                                     packageversion = node.InnerText;
                                 }
+                                node = doc.SelectSingleNode("/package/metadata/projectUrl");
+                                if (node != null)
+                                {
+                                    packageurl = node.InnerText;
+                                }
                                 reader.Close();
                                 break;
                             }
@@ -258,8 +262,15 @@ namespace Oqtane.Infrastructure
                     }
 
                     // ensure package version is greater than or equal to current framework version
-                    if (packageversion != "" && Version.Parse(Constants.Version).CompareTo(Version.Parse(packageversion)) <= 0)
+                    if (packageversion != "" && Version.Parse(Constants.Version).CompareTo(Version.Parse(packageversion)) <= 0 && packageurl != "")
                     {
+                        // install upgrade nuget package
+                        InstallPackages();
+                        // download upgrade zip package
+                        var client = new WebClient();
+                        Uri uri = new Uri(packageurl);
+                        client.DownloadFile(packageurl, Path.Combine(folder, uri.Segments[uri.Segments.Length - 1]));
+                        // install upgrade zip package
                         FinishUpgrade();
                     }
                 }

Oqtane.Server/Repository/FileRepository.cs

@@ -55,7 +55,6 @@ namespace Oqtane.Repository
         public File GetFile(int fileId)
         {
             File file = GetFile(fileId, true);
-            file.Url = GetFileUrl(file, _tenants.GetAlias());
             return file;
         }
 

Oqtane.Upgrade/Program.cs

@@ -2,7 +2,6 @@ using System;
 using System.Collections.Generic;
 using System.IO;
 using System.IO.Compression;
-using System.Reflection;
 using System.Threading;
 
 namespace Oqtane.Upgrade
@@ -20,10 +19,9 @@ namespace Oqtane.Upgrade
 
             if (args.Length == 2)
             {
-                string binfolder = Path.GetDirectoryName(Assembly.GetEntryAssembly().Location);
                 string contentrootfolder = args[0];
                 string webrootfolder = args[1];
-                string deployfolder = Path.Combine(webrootfolder, "Framework");
+                string deployfolder = Path.Combine(contentrootfolder, "Packages");
 
                 if (Directory.Exists(deployfolder))
                 {
@@ -48,20 +46,7 @@ namespace Oqtane.Upgrade
                         {
                             foreach (ZipArchiveEntry entry in archive.Entries)
                             {
-                                string filename = Path.GetFileName(entry.FullName);
+                                files.Add(Path.Combine(contentrootfolder, entry.FullName));
-                                if (!string.IsNullOrEmpty(filename))
-                                {
-                                    // use top level folder to determine location to extract files
-                                    switch (Path.GetDirectoryName(entry.FullName).Split(Path.DirectorySeparatorChar)[0])
-                                    {
-                                        case "lib":
-                                            files.Add(Path.Combine(binfolder, filename));
-                                            break;
-                                        case "wwwroot":
-                                            files.Add(Path.Combine(webrootfolder, entry.FullName.Replace("wwwroot/", "").Replace('/', Path.DirectorySeparatorChar)));
-                                            break;
-                                    }
-                                }
                             }
                         }
 
@@ -92,28 +77,12 @@ namespace Oqtane.Upgrade
                                     {
                                         foreach (ZipArchiveEntry entry in archive.Entries)
                                         {
-                                            string filename = Path.GetFileName(entry.FullName);
+                                            string filename = Path.Combine(contentrootfolder, entry.FullName);
-                                            if (!string.IsNullOrEmpty(filename))
+                                            if (!Directory.Exists(Path.GetDirectoryName(filename)))
                                             {
-                                                // use top level folder to determine location to extract files
+                                                Directory.CreateDirectory(Path.GetDirectoryName(filename));
-                                                switch (Path.GetDirectoryName(entry.FullName).Split(Path.DirectorySeparatorChar)[0])
-                                                {
-                                                    case "lib":
-                                                        filename = Path.Combine(binfolder, filename);
-                                                        break;
-                                                    case "wwwroot":
-                                                        filename = Path.Combine(webrootfolder, entry.FullName.Replace("wwwroot/", "").Replace('/', Path.DirectorySeparatorChar));
-                                                        break;
-                                                }
-                                                if (files.Contains(filename))
-                                                {
-                                                    if (!Directory.Exists(Path.GetDirectoryName(filename)))
-                                                    {
-                                                        Directory.CreateDirectory(Path.GetDirectoryName(filename));
-                                                    }
-                                                    entry.ExtractToFile(filename, true);
-                                                }
                                             }
+                                            entry.ExtractToFile(filename, true);
                                         }
                                     }
                                 }
@@ -156,7 +125,7 @@ namespace Oqtane.Upgrade
                             }
                             catch (Exception ex)
                             {
-                                Console.WriteLine("Update Not Successful: " + ex.Message);
+                                Console.WriteLine("Upgrade Not Successful: " + ex.Message);
                             }
                         }
                         else