Merge branch 'master' of https://github.com/oqtane/oqtane.framework into IClientStartup

Oqtane.Client/Modules/Admin/Files/Edit.razor

@@ -149,12 +149,18 @@
                 {
                     folder = await FolderService.AddFolderAsync(folder);
                 }
-
+                if (folder != null)
+                {
                     await FolderService.UpdateFolderOrderAsync(folder.SiteId, folder.FolderId, folder.ParentId);
                     await logger.LogInformation("Folder Saved {Folder}", folder);
                     NavigationManager.NavigateTo(NavigateUrl());
                 }
                 else
+                {
+                    AddModuleMessage("An Error Was Encountered Saving The Folder", MessageType.Error);
+                }
+            }
+            else
             {
                 AddModuleMessage("Folders Must Have A Parent And A Name", MessageType.Warning);
             }

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/Client/Edit.razor

@@ -4,9 +4,8 @@
 
 @namespace [Owner].[Module]s.Modules
 @inherits ModuleBase
+@inject I[Module]Service [Module]Service
 @inject NavigationManager NavigationManager
-@inject HttpClient http
-@inject SiteState sitestate
 
 <table class="table table-borderless">
     <tr>
@@ -31,7 +30,6 @@
     public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Edit;
     public override string Actions => "Add,Edit";
 
-    I[Module]Service [Module]Service;
     int _id;
     string _name;
     string _createdby;
@@ -43,7 +41,6 @@
     {
         try
         {
-            [Module]Service = new [Module]Service(http, sitestate);
             if (PageState.Action == "Edit")
             {
                 _id = Int32.Parse(PageState.QueryString["id"]);

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/Client/Index.razor

@@ -3,9 +3,8 @@
 
 @namespace [Owner].[Module]s.Modules
 @inherits ModuleBase
+@inject I[Module]Service [Module]Service
 @inject NavigationManager NavigationManager
-@inject HttpClient http
-@inject SiteState sitestate
 
 @if (_[Module]s == null)
 {
@@ -71,14 +70,12 @@ else
 <!-- The content above is for informational purposes only and can be safely removed -->
 
 @code {
-    I[Module]Service [Module]Service;
     List<[Module]> _[Module]s;
 
     protected override async Task OnInitializedAsync()
     {
         try
         {
-            [Module]Service = new [Module]Service(http, sitestate);
             _[Module]s = await [Module]Service.Get[Module]sAsync(ModuleState.ModuleId);
         }
         catch (Exception ex)

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/Client/ModuleInfo.cs

@@ -10,7 +10,6 @@ namespace [Owner].[Module]s.Modules
             Name = "[Module]",
             Description = "[Module]",
             Version = "1.0.0",
-            Dependencies = "[Owner].[Module]s.Shared.Oqtane",
             ServerManagerType = "[ServerManagerType]",
             ReleaseVersions = "1.0.0"
         };

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/Internal/Oqtane.Client/Modules/[Module]/Edit.razor

@@ -4,9 +4,8 @@
 
 @namespace [Owner].[Module]s.Modules
 @inherits ModuleBase
+@inject I[Module]Service [Module]Service
 @inject NavigationManager NavigationManager
-@inject HttpClient http
-@inject SiteState sitestate
 
 <table class="table table-borderless">
     <tr>
@@ -31,7 +30,6 @@
     public override SecurityAccessLevel SecurityAccessLevel => SecurityAccessLevel.Edit;
     public override string Actions => "Add,Edit";
 
-    I[Module]Service [Module]Service;
     int _id;
     string _name;
     string _createdby;
@@ -43,7 +41,6 @@
     {
         try
         {
-            [Module]Service = new [Module]Service(http, sitestate);
             if (PageState.Action == "Edit")
             {
                 _id = Int32.Parse(PageState.QueryString["id"]);

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/Internal/Oqtane.Client/Modules/[Module]/Index.razor

@@ -3,9 +3,8 @@
 
 @namespace [Owner].[Module]s.Modules
 @inherits ModuleBase
+@inject I[Module]Service [Module]Service
 @inject NavigationManager NavigationManager
-@inject HttpClient http
-@inject SiteState sitestate
 
 @if (_[Module]s == null)
 {
@@ -62,14 +61,12 @@ else
 <!-- The content above is for informational purposes only and can be safely removed -->
 
 @code {
-    I[Module]Service [Module]Service;
     List<[Module]> _[Module]s;
 
     protected override async Task OnInitializedAsync()
     {
         try
         {
-            [Module]Service = new [Module]Service(http, sitestate);
             _[Module]s = await [Module]Service.Get[Module]sAsync(ModuleState.ModuleId);
         }
         catch (Exception ex)

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/Internal/Oqtane.Client/Modules/[Module]/ModuleInfo.cs

@@ -10,7 +10,6 @@ namespace [Owner].[Module]s.Modules
             Name = "[Module]",
             Description = "[Module]",
             Version = "1.0.0",
-            Dependencies = "[Owner].[Module]s.Module.Shared",
             ServerManagerType = "[ServerManagerType]",
             ReleaseVersions = "1.0.0"
         };

Oqtane.Client/Modules/HtmlText/Edit.razor

@@ -3,9 +3,8 @@
 @using Oqtane.Modules.Controls
 @namespace Oqtane.Modules.HtmlText
 @inherits ModuleBase
+@inject IHtmlTextService HtmlTextService
 @inject NavigationManager NavigationManager
-@inject HttpClient http
-@inject SiteState sitestate
 
 @if (_content != null)
 {
@@ -14,7 +13,8 @@
     <NavLink class="btn btn-secondary" href="@NavigateUrl()">Cancel</NavLink>
     @if (!string.IsNullOrEmpty(_content))
     {
-        <br /><br />
+        <br />
+        <br />
         <AuditInfo CreatedBy="@_createdby" CreatedOn="@_createdon" ModifiedBy="@_modifiedby" ModifiedOn="@_modifiedon"></AuditInfo>
     }
 }
@@ -35,8 +35,7 @@
     {
         try
         {
-            var htmltextservice = new HtmlTextService(http, sitestate);
+            var htmltext = await HtmlTextService.GetHtmlTextAsync(ModuleState.ModuleId);
-            var htmltext = await htmltextservice.GetHtmlTextAsync(ModuleState.ModuleId);
             if (htmltext != null)
             {
                 _content = htmltext.Content;
@@ -65,19 +64,18 @@
 
         try
         {
-            var htmltextservice = new HtmlTextService(http, sitestate);
+            var htmltext = await HtmlTextService.GetHtmlTextAsync(ModuleState.ModuleId);
-            var htmltext = await htmltextservice.GetHtmlTextAsync(ModuleState.ModuleId);
             if (htmltext != null)
             {
                 htmltext.Content = content;
-                await htmltextservice.UpdateHtmlTextAsync(htmltext);
+                await HtmlTextService.UpdateHtmlTextAsync(htmltext);
             }
             else
             {
                 htmltext = new HtmlTextInfo();
                 htmltext.ModuleId = ModuleState.ModuleId;
                 htmltext.Content = content;
-                await htmltextservice.AddHtmlTextAsync(htmltext);
+                await HtmlTextService.AddHtmlTextAsync(htmltext);
             }
 
             await logger.LogInformation("Html/Text Content Saved {HtmlText}", htmltext);

Oqtane.Client/Modules/HtmlText/Index.razor

@@ -1,21 +1,13 @@
 @using Oqtane.Modules.HtmlText.Services
-@using Oqtane.Modules.HtmlText.Models
 @namespace Oqtane.Modules.HtmlText
 @inherits ModuleBase
-@inject NavigationManager NavigationManager
+@inject IHtmlTextService HtmlTextService
-@inject HttpClient http
-@inject SiteState sitestate
 
 @((MarkupString)content)
 
 @if (PageState.EditMode)
 {
-    <br />
+    <br /><ActionLink Action="Edit" /><br /><br />
-}
-<ActionLink Action="Edit" />
-@if (PageState.EditMode)
-{
-    <br /><br />
 }
 
 @code {
@@ -25,8 +17,7 @@
     {
         try
         {
-            var htmltextservice = new HtmlTextService(http, sitestate);
+            var htmltext = await HtmlTextService.GetHtmlTextAsync(ModuleState.ModuleId);
-            var htmltext = await htmltextservice.GetHtmlTextAsync(ModuleState.ModuleId);
             if (htmltext != null)
             {
                 content = htmltext.Content;

Oqtane.Client/Modules/HtmlText/Services/HtmlTextService.cs

@@ -8,7 +8,7 @@ using Oqtane.Shared;
 
 namespace Oqtane.Modules.HtmlText.Services
 {
-    public class HtmlTextService : ServiceBase, IHtmlTextService
+    public class HtmlTextService : ServiceBase, IHtmlTextService, IService
     {        
         private readonly SiteState _siteState;
 

Oqtane.Client/Themes/BlazorTheme/Container.razor

@@ -2,7 +2,9 @@
 @inherits ContainerBase
 <div class="container">
     <div class="row px-4">
+        <div class="d-flex flex-nowrap">
             <ModuleActions /><h2><ModuleTitle /></h2>
+        </div>
         <hr class="app-rule" />
     </div>
     <div class="row px-4">

Oqtane.Client/Themes/Controls/MenuHorizontal.Razor

@@ -3,9 +3,11 @@
 @attribute [OqtaneIgnore]
 @if (MenuPages.Any())
 {
+    <span class="app-menu-toggler">
         <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#Menu" aria-controls="Menu" aria-expanded="false" aria-label="Toggle Navigation">
             <span class="navbar-toggler-icon"></span>
         </button>
+    </span>
     <div class="app-menu">
         <div class="collapse navbar-collapse" id="Menu">
             <ul class="navbar-nav mr-auto">

Oqtane.Client/Themes/Controls/MenuVertical.razor

@@ -3,9 +3,11 @@
 @attribute [OqtaneIgnore]
 @if (MenuPages.Any())
 {
+    <span class="app-menu-toggler">
         <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#Menu" aria-controls="Menu" aria-expanded="false" aria-label="Toggle Navigation">
             <span class="navbar-toggler-icon"></span>
         </button>
+    </span>
     <div class="app-menu">
         <div class="collapse navbar-collapse" id="Menu">
             <ul class="nav flex-column">

Oqtane.Client/Themes/OqtaneTheme/Container.razor

@@ -2,7 +2,9 @@
 @inherits ContainerBase
 <div class="container">
     <div class="row px-4">
+        <div class="d-flex flex-nowrap">
             <ModuleActions /><h2><ModuleTitle /></h2>
+        </div>
         <hr class="app-rule" />
     </div>
     <div class="row px-4">

Oqtane.Client/Themes/OqtaneTheme/Default.razor

@@ -8,7 +8,7 @@
             <div class="controls-group"><UserProfile /> <Login /> <ControlPanel /></div>
         </div>
     </nav>
-    <div class="container">
+    <div class="content container">
         <PaneLayout />
         <div class="row px-4">
             <Pane Name="Admin" />

Oqtane.Server/Controllers/FileController.cs

@@ -16,6 +16,7 @@ using System.Net;
 using Oqtane.Enums;
 using Oqtane.Infrastructure;
 using Oqtane.Repository;
+using Microsoft.AspNetCore.Routing.Constraints;
 
 // ReSharper disable StringIndexOfIsCultureSpecific.1
 
@@ -194,7 +195,7 @@ namespace Oqtane.Controllers
                 CreateDirectory(folderPath);
                 string filename = url.Substring(url.LastIndexOf("/", StringComparison.Ordinal) + 1);
                 // check for allowable file extensions
-                if (Constants.UploadableFiles.Contains(Path.GetExtension(filename).Replace(".", "")))
+                if (Constants.UploadableFiles.Split(',').Contains(Path.GetExtension(filename).ToLower().Replace(".", "")))
                 {
                     try
                     {
@@ -317,7 +318,7 @@ namespace Oqtane.Controllers
                     }
 
                     // check for allowable file extensions
-                    if (!Constants.UploadableFiles.Contains(Path.GetExtension(filename)?.Replace(".", "")))
+                    if (!Constants.UploadableFiles.Split(',').Contains(Path.GetExtension(filename)?.ToLower().Replace(".", "")))
                     {
                         System.IO.File.Delete(Path.Combine(folder, filename + ".tmp"));
                     }
@@ -396,6 +397,7 @@ namespace Oqtane.Controllers
         [HttpGet("download/{id}")]
         public IActionResult Download(int id)
         {
+            string errorpath = Path.Combine(GetFolderPath("images"), "error.png");
             Models.File file = _files.GetFile(id);
             if (file != null)
             {
@@ -411,21 +413,24 @@ namespace Oqtane.Controllers
                     {
                         _logger.Log(LogLevel.Error, this, LogFunction.Read, "File Does Not Exist {FileId} {FilePath}", id, filepath);
                         HttpContext.Response.StatusCode = 404;
-                        return null;
+                        byte[] filebytes = System.IO.File.ReadAllBytes(errorpath);
+                        return File(filebytes, "application/octet-stream", file.Name);
                     }
                 }
                 else
                 {
                     _logger.Log(LogLevel.Error, this, LogFunction.Read, "User Not Authorized To Access File {FileId}", id);
                     HttpContext.Response.StatusCode = 401;
-                    return null;
+                    byte[] filebytes = System.IO.File.ReadAllBytes(errorpath);
+                    return File(filebytes, "application/octet-stream", file.Name);
                 }
             }
             else
             {
                 _logger.Log(LogLevel.Error, this, LogFunction.Read, "File Not Found {FileId}", id);
                 HttpContext.Response.StatusCode = 404;
-                return null;
+                byte[] filebytes = System.IO.File.ReadAllBytes(errorpath);
+                return File(filebytes, "application/octet-stream", "error.png");
             }
         }
 
@@ -469,7 +474,7 @@ namespace Oqtane.Controllers
             file.ImageHeight = 0;
             file.ImageWidth = 0;
 
-            if (Constants.ImageFiles.Contains(file.Extension))
+            if (Constants.ImageFiles.Split(',').Contains(file.Extension.ToLower()))
             {
                 FileStream stream = new FileStream(filepath, FileMode.Open, FileAccess.Read);
                 using (var image = Image.FromStream(stream))

Oqtane.Server/Controllers/FolderController.cs

@@ -10,7 +10,6 @@ using Oqtane.Extensions;
 using Oqtane.Infrastructure;
 using Oqtane.Repository;
 using Oqtane.Security;
-using System.IO;
 
 namespace Oqtane.Controllers
 {
@@ -105,16 +104,26 @@ namespace Oqtane.Controllers
                     }.EncodePermissions();
                 }
                 if (_userPermissions.IsAuthorized(User,PermissionNames.Edit, permissions))
+                {
+                    if (FolderPathValid(folder))
                     {
                         if (string.IsNullOrEmpty(folder.Path) && folder.ParentId != null)
                         {
                             Folder parent = _folders.GetFolder(folder.ParentId.Value);
-                        folder.Path = Utilities.PathCombine(parent.Path, folder.Name,"\\");
+                            folder.Path = Utilities.PathCombine(parent.Path, folder.Name);
                         }
+                        folder.Path = Utilities.PathCombine(folder.Path, "\\");
                         folder = _folders.AddFolder(folder);
                         _logger.Log(LogLevel.Information, this, LogFunction.Create, "Folder Added {Folder}", folder);
                     }
                     else
+                    {
+                        _logger.Log(LogLevel.Information, this, LogFunction.Create, "Folder Name Not Valid {Folder}", folder);
+                        HttpContext.Response.StatusCode = 401;
+                        folder = null;
+                    }
+                }
+                else
                 {
                     _logger.Log(LogLevel.Error, this, LogFunction.Create, "User Not Authorized To Add Folder {Folder}", folder);
                     HttpContext.Response.StatusCode = 401;
@@ -130,16 +139,26 @@ namespace Oqtane.Controllers
         public Folder Put(int id, [FromBody] Folder folder)
         {
             if (ModelState.IsValid && _userPermissions.IsAuthorized(User, EntityNames.Folder, folder.FolderId, PermissionNames.Edit))
+            {
+                if (FolderPathValid(folder))
                 {
                     if (string.IsNullOrEmpty(folder.Path) && folder.ParentId != null)
                     {
                         Folder parent = _folders.GetFolder(folder.ParentId.Value);
-                    folder.Path = Utilities.PathCombine(parent.Path, folder.Name,"\\");
+                        folder.Path = Utilities.PathCombine(parent.Path, folder.Name);
                     }
+                    folder.Path = Utilities.PathCombine(folder.Path, "\\");
                     folder = _folders.UpdateFolder(folder);
                     _logger.Log(LogLevel.Information, this, LogFunction.Update, "Folder Updated {Folder}", folder);
                 }
                 else
+                {
+                    _logger.Log(LogLevel.Information, this, LogFunction.Create, "Folder Name Not Valid {Folder}", folder);
+                    HttpContext.Response.StatusCode = 401;
+                    folder = null;
+                }
+            }
+            else
             {
                 _logger.Log(LogLevel.Error, this, LogFunction.Update, "User Not Authorized To Update Folder {Folder}", folder);
                 HttpContext.Response.StatusCode = 401;
@@ -191,5 +210,11 @@ namespace Oqtane.Controllers
                 HttpContext.Response.StatusCode = 401;
             }
         }
+
+        private bool FolderPathValid(Folder folder)
+        {
+            // prevent folder path traversal and reserved devices
+            return (!folder.Name.Contains("\\") && !folder.Name.Contains("/") && !Constants.ReservedDevices.Split(',').Contains(folder.Name.ToUpper()));
+        }
     }
 }

Oqtane.Server/Controllers/SiteTemplateController.cs

@@ -1,7 +1,9 @@
 using System.Collections.Generic;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Oqtane.Models;
 using Oqtane.Repository;
+using Oqtane.Shared;
 
 namespace Oqtane.Controllers
 {
@@ -17,6 +19,7 @@ namespace Oqtane.Controllers
 
         // GET: api/<controller>
         [HttpGet]
+        [Authorize(Roles = Constants.HostRole)]
         public IEnumerable<SiteTemplate> Get()
         {
             return _siteTemplates.GetSiteTemplates();

Oqtane.Server/wwwroot/Themes/Oqtane.Themes.BlazorTheme/Theme.css

@@ -37,6 +37,10 @@
         top: -2px;
     }
 
+.app-menu {
+    width: 100%
+}
+
 .breadcrumb {
     margin-bottom: 0;
 }
@@ -97,6 +101,12 @@
         flex-direction: row;
     }
 
+    .app-logo {
+        display: block;
+        margin-left: auto;
+        margin-right: auto;
+    }
+
     .breadcrumbs {
         position: fixed;
         left: 275px;
@@ -160,6 +170,12 @@
 }
 
 @media (max-width: 767px) {
+    .app-logo {
+        height: 80px;
+        display: flex;
+        align-items: center;
+    }
+
     .breadcrumbs {
         position: fixed;
         top: 150px;

Oqtane.Server/wwwroot/Themes/Oqtane.Themes.OqtaneTheme/Theme.css

@@ -47,6 +47,11 @@ body {
 }
 
 @media (max-width: 767px) {
+
+    .app-menu {
+        width: 100%
+    }
+
     .navbar {
         position: fixed;
         top: 60px;
@@ -67,8 +72,8 @@ body {
         margin-right: 25px;
     }
 
-    .container {
+    .content {
         position: relative;
-        top: 30px;
+        top: 60px;
     }
 }

Oqtane.Server/wwwroot/js/interop.js

@@ -81,15 +81,27 @@ window.interop = {
             if (link.href !== url) {
                 link.setAttribute('href', url);
             }
-            if (type !== "" && link.type !== type) {
+            if (type !== "") {
+                if (link.type !== type) {
                     link.setAttribute('type', type);
                 }
-            if (integrity !== "" && link.integrity !== integrity) {
+            } else {
+                link.removeAttribute('type');
+            }
+            if (integrity !== "") {
+                if (link.integrity !== integrity) {
                     link.setAttribute('integrity', integrity);
                 }
-            if (crossorigin !== "" && link.crossOrigin !== crossorigin) {
+            } else {
+                link.removeAttribute('integrity');
+            }
+            if (crossorigin !== "") {
+                if (link.crossOrigin !== crossorigin) {
                     link.setAttribute('crossorigin', crossorigin);
                 }
+            } else {
+                link.removeAttribute('crossorigin');
+            }
         }
     },
     includeScript: function (id, src, content, location, integrity, crossorigin) {
@@ -126,12 +138,20 @@ window.interop = {
                 if (script.src !== src) {
                     script.src = src;
                 }
-                if (integrity !== "" && script.integrity !== integrity) {
+                if (integrity !== "") {
+                    if (script.integrity !== integrity) {
                         script.setAttribute('integrity', integrity);
                     }
-                if (crossorigin !== "" && script.crossorigin !== crossorigin) {
+                } else {
+                    script.removeAttribute('integrity');
+                }
+                if (crossorigin !== "") {
+                    if (script.crossOrigin !== crossorigin) {
                         script.setAttribute('crossorigin', crossorigin);
                     }
+                } else {
+                    script.removeAttribute('crossorigin');
+                }
             }
             else {
                 if (script.innerHTML !== content) {

Oqtane.Shared/Interfaces/IModuleControl.cs

@@ -7,6 +7,6 @@ namespace Oqtane.Modules
         SecurityAccessLevel SecurityAccessLevel { get; } // defines the security access level for this control - defaults to View
         string Title { get; } // title to display for this control - defaults to module title
         string Actions { get; } // allows for routing by configuration rather than by convention ( comma delimited ) - defaults to using component file name
-        bool UseAdminContainer { get; } // container for embedding module control - defaults to true
+        bool UseAdminContainer { get; } // container for embedding module control - defaults to true. false will suppress the default modal UI popup behavior and render the component in the page.
     }
 }

Oqtane.Shared/Shared/Constants.cs

@@ -43,5 +43,6 @@
 
         public const string ImageFiles = "jpg,jpeg,jpe,gif,bmp,png";
         public const string UploadableFiles = "jpg,jpeg,jpe,gif,bmp,png,mov,wmv,avi,mp4,mp3,doc,docx,xls,xlsx,ppt,pptx,pdf,txt,zip,nupkg";
+        public const string ReservedDevices = "CON,NUL,PRN,COM1,COM2,COM3,COM4,COM5,COM6,COM7,COM8,COM9,LPT1,LPT2,LPT3,LPT4,LPT5,LPT6,LPT7,LPT8,LPT9";
     }
 }