Merge pull request #10 from oqtane/master

Sync master

Oqtane.Client/Modules/Admin/Files/Add.razor

@@ -1,4 +1,5 @@
 @namespace Oqtane.Modules.Admin.Files
+@using System.IO
 @inherits ModuleBase
 @inject NavigationManager NavigationManager
 @inject IFileService FileService
@@ -70,19 +71,33 @@
 
     private async Task Download()
     {
-        try
+        if (url == string.Empty || _folderId == -1)
         {
-            if (url != string.Empty && _folderId != -1)
+            AddModuleMessage("You Must Enter A Url And Select A Folder", MessageType.Warning);
+            return;
+        }
+
+        var filename = url.Substring(url.LastIndexOf("/", StringComparison.Ordinal) + 1);
+
+        if (!Constants.UploadableFiles.Split(',')
+                .Contains(Path.GetExtension(filename).ToLower().Replace(".", "")))
+            {
+                AddModuleMessage("File Could Not Be Downloaded From Url Due To Its File Extension", MessageType.Warning);
+                return ;
+            }
+
+        if (!filename.IsPathOrFileValid())
+        {
+            AddModuleMessage("You Must Enter A Url With A Valid File Name", MessageType.Warning);
+            return;
+        }
+
+        try
         {
             await FileService.UploadFileAsync(url, _folderId);
             await logger.LogInformation("File Downloaded Successfully From Url {Url}", url);
             AddModuleMessage("File Downloaded Successfully From Url", MessageType.Success);
         }
-            else
-            {
-                AddModuleMessage("You Must Enter A Url And Select A Folder", MessageType.Warning);
-            }
-        }
         catch (Exception ex)
         {
             await logger.LogError(ex, "Error Downloading File From Url {Url} {Error}", url, ex.Message);

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/Package/[Owner].[Module]s.nuspec

@@ -27,5 +27,6 @@
     <file src="..\Shared\bin\Release\netstandard2.1\[Owner].[Module]s.Shared.Oqtane.dll" target="lib" /> 
     <file src="..\Shared\bin\Release\netstandard2.1\[Owner].[Module]s.Shared.Oqtane.pdb" target="lib" /> 
     <file src="..\wwwroot\**\*.*" target="wwwroot" /> 
+    <file src="..\content\**\*.*" target="content" /> 
   </files>
 </package>

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/content/resources.txt

@@ -0,0 +1 @@
+This is the location where static resources for third party libraries should be located ( the third party library assemblies will be included in the /lib folder ). They should be placed in subfolders which match the naming convention of the third party library. When the module package is deployed the static resource subfolders will be extracted under the web root.

Oqtane.Client/Modules/Admin/ModuleCreator/Templates/External/wwwroot/resources.txt

@@ -1 +1 @@
-This is the location where static resources such as images or style sheets should be located
+This is the location where static resources such as images or style sheets for this module will be located. Static assets can be organized in subfolders. When the module package is deployed the assets will be extracted under the web root in a folder that matches the module name.

Oqtane.Client/Services/SettingService.cs

@@ -1,4 +1,5 @@
-using Oqtane.Models;
+using System;
+using Oqtane.Models;
 using System.Threading.Tasks;
 using System.Net.Http;
 using System.Linq;
@@ -106,7 +107,7 @@ namespace Oqtane.Services
 
             foreach (KeyValuePair<string, string> kvp in settings)
             {
-                Setting setting = settingsList.FirstOrDefault(item => item.SettingName == kvp.Key);
+                Setting setting = settingsList.FirstOrDefault(item => item.SettingName.Equals(kvp.Key,StringComparison.OrdinalIgnoreCase));
                 if (setting == null)
                 {
                     setting = new Setting();

Oqtane.Server/Controllers/FileController.cs

@@ -189,14 +189,37 @@ namespace Oqtane.Controllers
         {
             Models.File file = null;
             Folder folder = _folders.GetFolder(int.Parse(folderid));
-            if (folder != null && _userPermissions.IsAuthorized(User, PermissionNames.Edit, folder.Permissions))
+
+            if (folder == null || !_userPermissions.IsAuthorized(User, PermissionNames.Edit, folder.Permissions))
             {
+                _logger.Log(LogLevel.Error, this, LogFunction.Create,
+                    "User Not Authorized To Download File {Url} {FolderId}", url, folderid);
+                HttpContext.Response.StatusCode = 401;
+                return file;
+            }
+
             string folderPath = GetFolderPath(folder);
             CreateDirectory(folderPath);
+
             string filename = url.Substring(url.LastIndexOf("/", StringComparison.Ordinal) + 1);
             // check for allowable file extensions
-                if (Constants.UploadableFiles.Split(',').Contains(Path.GetExtension(filename).ToLower().Replace(".", "")))
+            if (!Constants.UploadableFiles.Split(',')
+                .Contains(Path.GetExtension(filename).ToLower().Replace(".", "")))
             {
+                _logger.Log(LogLevel.Error, this, LogFunction.Create,
+                    "File Could Not Be Downloaded From Url Due To Its File Extension {Url}", url);
+                HttpContext.Response.StatusCode = (int)HttpStatusCode.Conflict;
+                return file;
+            }
+
+            if (!filename.IsPathOrFileValid())
+            {
+                _logger.Log(LogLevel.Error, this, LogFunction.Create,
+                    $"File Could Not Be Downloaded From Url Due To Its File Name Not Allowed {url}");
+                HttpContext.Response.StatusCode = (int)HttpStatusCode.Conflict;
+                return file;
+            }
+
             try
             {
                 var client = new WebClient();
@@ -208,22 +231,12 @@ namespace Oqtane.Controllers
                 }
 
                 client.DownloadFile(url, targetPath);
-                        _files.AddFile(CreateFile(filename, folder.FolderId, targetPath));
+                file = _files.AddFile(CreateFile(filename, folder.FolderId, targetPath));
             }
             catch
             {
-                        _logger.Log(LogLevel.Error, this, LogFunction.Create, "File Could Not Be Downloaded From Url {Url}", url);
+                _logger.Log(LogLevel.Error, this, LogFunction.Create,
-                    }
+                    "File Could Not Be Downloaded From Url {Url}", url);
-                }
-                else
-                {
-                    _logger.Log(LogLevel.Error, this, LogFunction.Create, "File Could Not Be Downloaded From Url Due To Its File Extension {Url}", url);
-                }
-            }
-            else
-            {
-                _logger.Log(LogLevel.Error, this, LogFunction.Create, "User Not Authorized To Download File {Url} {FolderId}", url, folderid);
-                HttpContext.Response.StatusCode = 401;
             }
 
             return file;
@@ -233,14 +246,24 @@ namespace Oqtane.Controllers
         [HttpPost("upload")]
         public async Task UploadFile(string folder, IFormFile file)
         {
-            if (file.Length > 0)
+            if (file.Length <= 0)
             {
+                return;
+            }
+
+            if (!file.FileName.IsPathOrFileValid())
+            {
+                HttpContext.Response.StatusCode = (int)HttpStatusCode.Conflict;
+                return;
+            }
+            
             string folderPath = "";
 
             if (int.TryParse(folder, out int folderId))
             {
                 Folder virtualFolder = _folders.GetFolder(folderId);
-                    if (virtualFolder != null && _userPermissions.IsAuthorized(User, PermissionNames.Edit, virtualFolder.Permissions))
+                if (virtualFolder != null &&
+                    _userPermissions.IsAuthorized(User, PermissionNames.Edit, virtualFolder.Permissions))
                 {
                     folderPath = GetFolderPath(virtualFolder);
                 }
@@ -269,11 +292,11 @@ namespace Oqtane.Controllers
             }
             else
             {
-                    _logger.Log(LogLevel.Error, this, LogFunction.Create, "User Not Authorized To Upload File {Folder} {File}", folder, file);
+                _logger.Log(LogLevel.Error, this, LogFunction.Create,
+                    "User Not Authorized To Upload File {Folder} {File}", folder, file);
                 HttpContext.Response.StatusCode = 401;
             }
         }
-        }
 
         private async Task<string> MergeFile(string folder, string filename)
         {

Oqtane.Server/Infrastructure/InstallationManager.cs

@@ -28,7 +28,7 @@ namespace Oqtane.Infrastructure
         {
             var webRootPath = _environment.WebRootPath;
             
-            var install = UnpackPackages(folders, webRootPath);
+            var install = InstallPackages(folders, webRootPath);
 
             if (install && restart)
             {
@@ -36,7 +36,7 @@ namespace Oqtane.Infrastructure
             }
         }
 
-        public static bool UnpackPackages(string folders, string webRootPath)
+        public static bool InstallPackages(string folders, string webRootPath)
         {
             bool install = false;
             string binFolder = Path.GetDirectoryName(Assembly.GetEntryAssembly()?.Location);
@@ -44,14 +44,12 @@ namespace Oqtane.Infrastructure
             foreach (string folder in folders.Split(','))
             {
                 string sourceFolder = Path.Combine(webRootPath, folder);
-
-                // create folder if it does not exist
                 if (!Directory.Exists(sourceFolder))
                 {
                     Directory.CreateDirectory(sourceFolder);
                 }
 
-                // iterate through packages
+                // iterate through Nuget packages in source folder
                 foreach (string packagename in Directory.GetFiles(sourceFolder, "*.nupkg"))
                 {
                     string name = Path.GetFileNameWithoutExtension(packagename);
@@ -89,29 +87,33 @@ namespace Oqtane.Infrastructure
                             // deploy to appropriate locations
                             foreach (ZipArchiveEntry entry in archive.Entries)
                             {
+                                string foldername = Path.GetDirectoryName(entry.FullName).Split('\\')[0];
                                 string filename = Path.GetFileName(entry.FullName);
-                                switch (Path.GetExtension(filename).ToLower())
+
+                                switch (foldername)
                                 {
-                                    case ".pdb":
+                                    case "lib":
-                                    case ".dll":
                                         if (binFolder != null) entry.ExtractToFile(Path.Combine(binFolder, filename), true);
                                         break;
-                                    case ".png":
+                                    case "wwwroot":
-                                    case ".jpg":
+                                        filename = Path.Combine(sourceFolder, Utilities.PathCombine(entry.FullName.Replace("wwwroot", name).Split('/')));
-                                    case ".jpeg":
-                                    case ".gif":
-                                    case ".svg":
-                                    case ".js":
-                                    case ".css":
-                                        string entryPath = Utilities.PathCombine(entry.FullName.Replace("wwwroot", name).Split('/'));
-                                        filename = Path.Combine(sourceFolder, entryPath);
                                         if (!Directory.Exists(Path.GetDirectoryName(filename)))
                                         {
                                             Directory.CreateDirectory(Path.GetDirectoryName(filename));
                                         }
-
                                         entry.ExtractToFile(filename, true);
                                         break;
+                                    case "content":
+                                        if (Path.GetDirectoryName(entry.FullName) != "content") // assets must be in subfolders
+                                        {
+                                            filename = Path.Combine(webRootPath, Utilities.PathCombine(entry.FullName.Replace("content", "").Split('/')));
+                                            if (!Directory.Exists(Path.GetDirectoryName(filename)))
+                                            {
+                                                Directory.CreateDirectory(Path.GetDirectoryName(filename));
+                                            }
+                                            entry.ExtractToFile(filename, true);
+                                        }
+                                        break;
                                 }
                             }
                         }

Oqtane.Server/Startup.cs

@@ -163,7 +163,7 @@ namespace Oqtane
             services.AddSingleton<IDatabaseManager, DatabaseManager>();
 
             // install any modules or themes ( this needs to occur BEFORE the assemblies are loaded into the app domain )
-            InstallationManager.UnpackPackages("Modules,Themes", _webRoot);
+            InstallationManager.InstallPackages("Modules,Themes", _webRoot);
 
             // register transient scoped core services
             services.AddTransient<IModuleDefinitionRepository, ModuleDefinitionRepository>();

Oqtane.Server/wwwroot/resources.txt

@@ -0,0 +1 @@
+This is the location where static resources such as images or style sheets should be located