Small width layout Medium width layout Maximum width layout Small text Medium text Large text
     Search
Downloads Downloads Directory Directory Forums Forums Forge Forge Blogs Blogs        Marketplace Marketplace Careers Program Careers
Community › Forums Register  |  

telerik -- supercharge your DNN websites
  Need Help?  
Professional technical support for DotNetNuke is available from DotNetNuke Corporation.
 


  Ads  
Active Modules -- Active Forums for DotNetNuke
 


  Sponsors  

Meet Our Sponsors

Jango Studios - Skins, Modules and Hosting for DotNetNuke
eUKhost.com is commited to offer exceptional UK Windows Web Hosting solutions with quality 24x7 technical support.Our plans support ASP.Net, ASP, ASP.NET Ajax extensions, XML, MSSQL, MySQL, PHP,DNN, multiple domains and Shared SSL as standard.
SmarterTools
The Official Microsoft ASP.NET Website
Portal Webhosting - Hosting For Developers
Red-Gate Software
 


DotNetNuke Forums
 
  Forum  General DotNetN...  Make it Hot! ( ...  Continued discussion from Gemini DNN-7134
Previous Previous
 
Next Next
New Post 3/13/2008 2:08 PM
User is offline Timo Breumelhof
1693 posts
5th Ranked




Continued discussion from Gemini DNN-7134 
Modified By Timo Breumelhof on 3/13/2008 5:17:27 PM)

There is a discussion in Gemini here, about  server side code in HTML skins.
Gemini is not the place to discuss this, so I would like to continue here.
The discussion is about the question if this should be allowed, not how to...

IMO if you allow an admin to upload ASCX skins then there's no reason to not allow server side code in HTML skins.
(then there is no real security risk, so no gain and it would be a breaking change)

Unless you would split up the admin skin upload permissions in two options

1. Allow upload of HTML skins (no ASCX)
2. Allow upload of HTML & ASCX skins

Then if option 1. is selected, it would make sense to strip all server side code from the skin...

(This might have been discussed before)

Any opinions?

BTW, IMO the upload portal skin option should be per portal.

Timo Breumelhof -- www.searchdotnetnuke.com -- Extended DNN (forum) search
 
New Post 3/14/2008 1:50 AM
User is offline Sebastian Leupold
14295 posts
www.deutschnetnuke.de
1st Ranked












Re: Continued discussion from Gemini DNN-7134 

splitting up permissions sounds like a good idea, though I am not sure about potential risks from e.g. flash objects included.

you are right, permissions shall be granted per portal (or, even better, per individual) including allowed file types.

Sebastian Leupold

DeutschNetNuke dnnWerk - The DotNetNuke Experts German DotNetNuke User-Group

DotNetNuke Project UserDefinedTable
DotNetNuke Project Release Tracker
 
New Post 3/14/2008 8:39 AM
User is offline Jeff Cochran
1391 posts
6th Ranked


Re: Continued discussion from Gemini DNN-7134 

I agree that there really isn't a valid security reason to block server side code in HTML skins if you allow ASCX skins to be uploaded.  And splitting permission would be the best method to handle this, though a commercial HTML skin with server side code might be an issue for some admins.  Skinners would need to differentiate the skins.  Of course, since this isn't going to happen for a while, and Cambrian might change a lot of skinning options, skins developed to DNN 5.x could magae this.

Jeff
 
New Post 3/14/2008 9:40 AM
User is offline keeperofstars
252 posts
9th Ranked


Re: Continued discussion from Gemini DNN-7134 

I could care less, just worried how well the parser could manage to actually parse out the right tags for the script section. It would have to identify the script tags for server side scripts and then position them correctly in the resulting ascx page, ensure all the additional custom registeries are managed, and well what good is having server side scripts if you can't modify the tokens directly anyways cause the parser is going to look for the xml for the token values / parameters. So you are looking to add page controls with custom server side code to manage them, so now the parser has to figure out which tags in the html is true html tags or asp.net tags (easy to do just more overhead for parser). Eh to me it seems like a full rewrite of the skin parser to accept all the possiblities, when all the person needs to do is change the extension from html to ascx. Why reinvent the wheel? 
 
New Post 3/14/2008 5:17 PM
User is offline Timo Breumelhof
1693 posts
5th Ranked




Re: Continued discussion from Gemini DNN-7134 
Modified By Timo Breumelhof on 3/14/2008 8:20:55 PM)

FYI, we were not discussing .NET code in script tags, I agree you should use an ASCX skin if you need that kind of functionality.

It was about "inline code" like: <%=Portalsettings.ActiveTab.TabName%> which the current skinparser doesn't touch, and would be easy to remove...

(I think the skinparser uses REGEX mostly so removing blocks with runat=server shouldn't be to difficult either)

Timo Breumelhof -- www.searchdotnetnuke.com -- Extended DNN (forum) search
 
 Page 1 of 41234Next 
Previous Previous
 
Next Next
  Forum  General DotNetN...  Make it Hot! ( ...  Continued discussion from Gemini DNN-7134
 


Forum Policy

These Discussion Forums are dedicated to the discussion of the DotNetNuke Web Application Framework.

For the benefit of the community and to protect the integrity of the project, please observe the following posting guidelines:

1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DotNetNuke.
2. Discussion or promotion of DotNetNuke product releases under a different brand name are strictly prohibited.
3. No Flaming or Trolling.
4. No Profanity, Racism, or Prejudice.
5. Site Moderators have the final word on approving/removing a thread or post or comment.
6. English language posting only, please.
 


Expressnet - DotNetNuke Hosting
Expressnet provide premium quality ASP.NET Web Hosting. We specialise in Windows based products including ASP.NET and Microsoft SQL Server. We offer fantastic value packages for DotNetNuke hosting. We also offer free asp.net web hosting
www.expressnet.com.au 		Softech Development, Inc.
We help your business work smarter with DotNetNuke. Whether you need a new implementation, a custom module or skin for an existing implementation, or integration with your business processes, Softech has the experience and expertise to make it happen.
www.softechdevelopment.com 		Module Development by Engage Software
Specializing in custom module development, training and skinning.
www.engagesoftware.com

DotNetNuke Corporation   Terms Of Use  Privacy Statement
DotNetNuke®, DNN®, and the DotNetNuke logo are trademarks of DotNetNuke Corporation
Hosted by MaximumASP