Continued discussion from Gemini DNN-7134 - Make it Hot! ( Skinning )

Forum General DotNetN... Make it Hot! ( ... Continued discussion from Gemini DNN-7134

3/13/2008 3:08 PM

	Timo Breumelhof
1760 posts

Continued discussion from Gemini DNN-7134

Modified By Timo Breumelhof on 3/13/2008 5:17:27 PM)

There is a discussion in Gemini here, about server side code in HTML skins.
Gemini is not the place to discuss this, so I would like to continue here.
The discussion is about the question if this should be allowed, not how to...

IMO if you allow an admin to upload ASCX skins then there's no reason to not allow server side code in HTML skins.
(then there is no real security risk, so no gain and it would be a breaking change)

Unless you would split up the admin skin upload permissions in two options

1. Allow upload of HTML skins (no ASCX)
2. Allow upload of HTML & ASCX skins

Then if option 1. is selected, it would make sense to strip all server side code from the skin...

(This might have been discussed before)

Any opinions?

BTW, IMO the upload portal skin option should be per portal.

Timo Breumelhof -- www.searchdotnetnuke.com -- Extended DNN (forum) search

3/14/2008 2:50 AM

	Sebastian Leupold
15227 posts
www.deutschnetnuke.de

Re: Continued discussion from Gemini DNN-7134

splitting up permissions sounds like a good idea, though I am not sure about potential risks from e.g. flash objects included.

you are right, permissions shall be granted per portal (or, even better, per individual) including allowed file types.

Sebastian Leupold

DotNetNuke Project UserDefinedTable
DotNetNuke Project Release Tracker

3/14/2008 9:39 AM

	Jeff Cochran
1558 posts

Re: Continued discussion from Gemini DNN-7134

I agree that there really isn't a valid security reason to block server side code in HTML skins if you allow ASCX skins to be uploaded. And splitting permission would be the best method to handle this, though a commercial HTML skin with server side code might be an issue for some admins. Skinners would need to differentiate the skins. Of course, since this isn't going to happen for a while, and Cambrian might change a lot of skinning options, skins developed to DNN 5.x could magae this.

Jeff

3/14/2008 10:40 AM

	keeperofstars
252 posts

Re: Continued discussion from Gemini DNN-7134

I could care less, just worried how well the parser could manage to actually parse out the right tags for the script section. It would have to identify the script tags for server side scripts and then position them correctly in the resulting ascx page, ensure all the additional custom registeries are managed, and well what good is having server side scripts if you can't modify the tokens directly anyways cause the parser is going to look for the xml for the token values / parameters. So you are looking to add page controls with custom server side code to manage them, so now the parser has to figure out which tags in the html is true html tags or asp.net tags (easy to do just more overhead for parser). Eh to me it seems like a full rewrite of the skin parser to accept all the possiblities, when all the person needs to do is change the extension from html to ascx. Why reinvent the wheel?

3/14/2008 6:17 PM

	Timo Breumelhof
1760 posts

Re: Continued discussion from Gemini DNN-7134

Modified By Timo Breumelhof on 3/14/2008 8:20:55 PM)

FYI, we were not discussing .NET code in script tags, I agree you should use an ASCX skin if you need that kind of functionality.

It was about "inline code" like: <%=Portalsettings.ActiveTab.TabName%> which the current skinparser doesn't touch, and would be easy to remove...

(I think the skinparser uses REGEX mostly so removing blocks with runat=server shouldn't be to difficult either)

Timo Breumelhof -- www.searchdotnetnuke.com -- Extended DNN (forum) search

Page 1 of 4

Forum

General DotNetN...

Make it Hot! ( ...

Continued discussion from Gemini DNN-7134