Skip to content

Commit 27453ce

Browse files
P1l3T0P1l3T0
committed
kb(asyncupload): adjsut article html sections
1 parent 8f12dd8 commit 27453ce

File tree

3 files changed

+355
-580
lines changed

3 files changed

+355
-580
lines changed

‎knowledge-base/asyncupload-insecure-direct-object-reference.md‎

Lines changed: 65 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -27,143 +27,69 @@ You can find more details and instructions at [Allows JavaScriptSerializer Dese
2727

2828
Also check the FAQ section at the end of the [Security article](https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security?&_ga=2.240996419.1514756545.1609746144-426342040.1588420200#frequently-asked-questions).
2929

30-
31-
<style>
32-
input.collapse-panel-toggle-checkbox {
33-
display: none;
34-
}
35-
36-
37-
.collapse-panel-toggle-lable {
38-
display: block;
39-
padding: 1rem;
40-
background: #f9edc6;
41-
cursor: pointer;
42-
transition: all 0.25s ease-out;
43-
}
44-
45-
.collapse-panel-toggle-lable::before {
46-
content: ' ';
47-
display: inline-block;
48-
border-top: 5px solid transparent;
49-
border-bottom: 5px solid transparent;
50-
border-left: 5px solid currentColor;
51-
vertical-align: middle;
52-
margin-right: .7rem;
53-
transform: translateY(-2px);
54-
transition: transform .2s ease-out;
55-
}
56-
57-
.collapse-panel-toggle-checkbox:checked + .collapse-panel-toggle-lable::before {
58-
transform: rotate(90deg) translateX(-3px);
59-
}
60-
61-
62-
.collapse-panel-content-wrapper {
63-
max-height: 0px;
64-
overflow: hidden;
65-
transition: max-height .25s ease-in-out;
66-
}
67-
68-
69-
.collapse-panel-toggle-checkbox:checked + .collapse-panel-toggle-lable + .collapse-panel-content-wrapper {
70-
max-height: unset;
71-
overflow: auto;
72-
}
73-
74-
75-
.collapse-panel-content-wrapper .collapse-panel-content {
76-
background: rgba(249,237,198, .2);
77-
border-bottom: 1px solid rgba(249,237,198, .45);
78-
padding: .5rem 1rem;
79-
}
80-
81-
.collapse-panel-content-wrapper p {
82-
margin-bottom: 0;
83-
}
84-
</style>
85-
<!--[if IE]>
86-
<style>
87-
.collapse-panel-content-wrapper {
88-
max-height: none;
89-
}
90-
</style>
91-
<![endif]-->
92-
93-
<div class="collapse-panel">
94-
<input id="collapse-panel-checkbox" class="collapse-panel-toggle-checkbox" type="checkbox">
95-
<label for="collapse-panel-checkbox" class="collapse-panel-toggle-lable">Deprecated Solutions</label>
96-
<div class="collapse-panel-content-wrapper">
97-
<div class="collapse-panel-content">
98-
<p>
99-
<p>To ensure your application is not exposed to risk, there are several mitigation paths.The recommended approach is to upgrade to the latest version and follow the steps in the <a href="https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security">RadAsyncUpload Security article</a>. You can find the other alternatives below.</p>
100-
101-
<p><strong>Update from 8 Sep 2017:</strong> You should follow one of these options even if you are not using RadAsyncUpload in your application.<br>
102-
<strong>Update from 23 Oct 2019:</strong>&nbsp;Information on avoiding the issue through general web.config networking settings was removed because it is not sufficiently safe.</p>
103-
104-
<ul>
105-
<li>Use a patch&nbsp;for versions between Q1 2011 (2011.1.315)&nbsp;and R2 2017 SP1 (2017.2.621).</li>
106-
<li>If you are on active maintenance,&nbsp;upgrade to R2 2017 SP2 (2017.2.711) or later.</li>
107-
</ul>
108-
109-
<p>NOTE: The patches are&nbsp;<strong>not</strong>&nbsp;available on the Telerik NuGet feed.</p>
110-
111-
<p>NOTE: If you are targeting .NET 3.5, review the&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/controls/fips-compatibility">FIPS Compatibility article</a>, because the encryption issue it describes also pertains to these patches.</p>
112-
113-
<hr>
114-
115-
<h4>Use a patch for versions between Q1 2011 (2011.1.315)&nbsp;and R2 2017 SP1 (2017.2.621)</h4>
116-
117-
<p>The R2 2017 SP2 release brings a fix and the ability to disable uploads for the first time. This fix was ported in the patches.</p>
118-
119-
<p>Download a patched version&nbsp;from your Telerik.com account&nbsp;<strong>after the 15th of August 2017</strong>. If you downloaded it earlier, download it again, because the file was updated since its <a href="https://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness">original creation</a>. Here is how to get the patch:</p>
120-
121-
<ol>
122-
<li><p>Go to your&nbsp;<a href="https://www.telerik.com/account/product-download?product=RCAJAX">telerik.com account</a>.</p></li>
123-
<li><p>From the Version dropdown, select your release:&nbsp;<br>
124-
<img src="images/asyncupload-insecure-direct-object-reference-version-dropdown.png" alt="How to select your Telerik.Web.UI version"></p></li>
125-
<li><p>Download the&nbsp;SecurityPatch_&lt;your_version&gt;.zip&nbsp;file.</p></li>
126-
<li><p><a href="http://docs.telerik.com/devtools/aspnet-ajax/installation/upgrading-instructions/upgrading-a-trial-to-a-developer-license-or-to-a-newer-version#manual-upgrade">Replace the Telerik.Web.UI assembly in your application</a>&nbsp;with the one of the same version that you just downloaded. Temporary files saved to the disk by RadAsyncUpload will now have the <code>.tmp</code> extension.</p></li>
127-
<li><p>*<em>(Updated on 23 Oct 2019): *</em>Set the encryption keys described in the <a href="https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security">RadAsyncUpload Security article</a>.</p></li>
128-
</ol>
129-
130-
<p>This patch brings an added security measure. After applying the patched DLL, you can now&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security#disableasyncuploadhandler">disable file uploads through the Telerik handler</a>. To do that, set the&nbsp;<strong>Telerik.Web.DisableAsyncUploadHandler</strong>&nbsp;key in the appSettings section of your web.config to&nbsp;<strong>true</strong>. You can then&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/how-to/how-to-extend-the-radasyncupload-handler">create a custom handler</a>&nbsp;with the desired level of security. If you do that, see the&nbsp;<a href="https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/uploadedfiles.saveas-throws-filenotfound-error-with-custom-handler">UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler</a>&nbsp;KB article.</p>
131-
132-
<p><strong>NOTE</strong>: Due to technical feasibility, the following versions do&nbsp;not&nbsp;have patches for this issue:</p>
133-
134-
<ul>
135-
<li>Q1 2011 SP2 (2011.1.519)</li>
136-
<li>Q2 2011 SP1 (2011.2.915)</li>
137-
<li>Q3 2011 SP1 (2011.3.1305)</li>
138-
<li>Q1 2012 SP1 (2012.1.411)</li>
139-
<li>Q2 2012 SP2 (2012.2.912)</li>
140-
</ul>
141-
142-
<p>The patched version shows "Telerik.Web.UI.Patch" in the File Description under Properties in Windows Explorer:</p>
143-
144-
<p>How to spot a patched version of Telerik.Web.UI.dll:</p>
145-
146-
<p><img src="images/asyncupload-insecure-direct-object-reference-patched-version.png" alt="How a patched version looks like"></p>
147-
148-
<p>Source code&nbsp;for building a&nbsp;patched&nbsp;version and&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/deployment/protecting-the-telerik-asp.net-ajax-assembly">protecting the Telerik.Web.UI assembly</a>&nbsp;is available as well. If you downloaded it before the 15th of August 2017, you can download it again, because the file was updated.</p>
149-
150-
<hr>
151-
152-
<h4>Upgrade to&nbsp;R2 2017 SP2&nbsp;(2017.2.711) or later if you’re on active maintenance.</h4>
153-
154-
<ol>
155-
<li>
156-
<a href="http://docs.telerik.com/devtools/aspnet-ajax/installation/upgrading-instructions/upgrading-a-trial-to-a-developer-license-or-to-a-newer-version#upgrade-to-a-newer-version-of-telerik-ui-for-aspnet-ajax">Upgrade&nbsp;your Telerik UI for ASP.NET AJAX version</a>to&nbsp;R2 2017 SP2&nbsp;(2017.2.711) or later.</li>
157-
<li>Set the encryption keys as explained in the <a href="https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security">RadAsyncUpload Security article</a>.</li>
158-
</ol>
159-
160-
<p>The R2 2017 SP2 (2017.2.711) release brings an additional security measure. It allows you to&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security#disableasyncuploadhandler">disable file uploads through the Telerik handler</a>. To do that, set the&nbsp;<strong>Telerik.Web.DisableAsyncUploadHandler</strong>&nbsp;key in the appSettings section of your web.config to&nbsp;<strong>true</strong>. You can then&nbsp;<a href="http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/how-to/how-to-extend-the-radasyncupload-handler">create a custom handler</a> with the desired level of security. If you do that, see the&nbsp;<a href="https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/uploadedfiles.saveas-throws-filenotfound-error-with-custom-handler">UploadedFiles.SaveAs Throws FileNotFound Error with Custom Handler</a>&nbsp;KB article.</p>
161-
162-
</p>
163-
</div>
164-
</div>
165-
</div>
166-
30+
## Deprecated solutions
31+
32+
>caption
33+
>
34+
>**Start of the deprecated solutions section:**
35+
>
36+
>To ensure your application is not exposed to risk, there are several mitigation paths. The recommended approach is to upgrade to the latest version and follow the steps in the [RadAsyncUpload Security article](https://docs.>telerik.com/devtools/aspnet-ajax/controls/asyncupload/security). You can find other alternatives below.
37+
>
38+
>**Update from 8 Sep 2017:** You should follow one of these options even if you are not using RadAsyncUpload in your application.
39+
>**Update from 23 Oct 2019:** Information on avoiding the issue through general web.config networking settings was removed because it is not sufficiently safe.
40+
>
41+
>- Use a patch for versions between Q1 2011 (2011.1.315) and R2 2017 SP1 (2017.2.621).
42+
>- If you are on active maintenance, upgrade to R2 2017 SP2 (2017.2.711) or later.
43+
>
44+
> **NOTE:** The patches are **not** available on the Telerik NuGet feed.
45+
>
46+
> **NOTE:** If you are targeting .NET 3.5, review the [FIPS Compatibility article](http://docs.telerik.com/devtools/aspnet-ajax/controls/fips-compatibility), because the encryption issue it describes also pertains to these >patches.
47+
>
48+
>---
49+
>
50+
>#### Use a patch for versions between Q1 2011 (2011.1.315) and R2 2017 SP1 (2017.2.621)
51+
>
52+
>The R2 2017 SP2 release brings a fix and the ability to disable uploads for the first time. This fix was ported in the patches.
53+
>
54+
>Download a patched version from your Telerik.com account **after the 15th of August 2017**. If you downloaded it earlier, download it again, because the file was updated since its [original creation](https://www.telerik.com/>support/kb/aspnet-ajax/details/cryptographic-weakness).
55+
>
56+
>Steps to get the patch:
57+
>1. Go to your [Telerik.com account](https://www.telerik.com/account/product-download?product=RCAJAX).
58+
59+
>2. From the Version dropdown, select your release:
60+
61+
> ![Version Dropdown](images/asyncupload-insecure-direct-object-reference-version-dropdown.png)
62+
63+
>3. Download the `SecurityPatch_<your_version>.zip` file.
64+
65+
>4. [Replace the Telerik.Web.UI assembly in your application](http://docs.telerik.com/devtools/aspnet-ajax/installation/upgrading-instructions/upgrading-a-trial-to-a-developer-license-or-to-a-newer-version#manual-upgrade) >with the one of the same version that you just downloaded. Temporary files saved to the disk by RadAsyncUpload will now have the `.tmp` extension.
66+
67+
>5. *(Updated on 23 Oct 2019):* Set the encryption keys described in the [RadAsyncUpload Security article](https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security).
68+
>
69+
>This patch brings an added security measure. After applying the patched DLL, you can now [disable file uploads through the Telerik handler](http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/>security#disableasyncuploadhandler). To do that, set the **Telerik.Web.DisableAsyncUploadHandler** key in the `appSettings` section of your web.config to **true**. You can then [create a custom handler](http://docs.telerik.>com/devtools/aspnet-ajax/controls/asyncupload/how-to/how-to-extend-the-radasyncupload-handler) with the desired level of security.
70+
>
71+
> **NOTE:** Due to technical feasibility, the following versions do not have patches for this issue:
72+
>
73+
> - Q1 2011 SP2 (2011.1.519)
74+
> - Q2 2011 SP1 (2011.2.915)
75+
> - Q3 2011 SP1 (2011.3.1305)
76+
> - Q1 2012 SP1 (2012.1.411)
77+
> - Q2 2012 SP2 (2012.2.912)
78+
>
79+
>The patched version shows "Telerik.Web.UI.Patch" in the File Description under Properties in Windows Explorer:
80+
>
81+
>![Patched Version](images/asyncupload-insecure-direct-object-reference-patched-version.png)
82+
>
83+
>---
84+
>
85+
>#### Upgrade to R2 2017 SP2 (2017.2.711) or later if you're on active maintenance
86+
>
87+
>1. [Upgrade your Telerik UI for ASP.NET AJAX version](http://docs.telerik.com/devtools/aspnet-ajax/installation/upgrading-instructions/>upgrading-a-trial-to-a-developer-license-or-to-a-newer-version#upgrade-to-a-newer-version-of-telerik-ui-for-aspnet-ajax) to R2 2017 SP2 (2017.2.711) or later.
88+
>2. Set the encryption keys as explained in the [RadAsyncUpload Security article](https://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/security).
89+
>
90+
>The R2 2017 SP2 (2017.2.711) release brings an additional security measure. It allows you to [disable file uploads through the Telerik handler](http://docs.telerik.com/devtools/aspnet-ajax/controls/asyncupload/>security#disableasyncuploadhandler). To do that, set the **Telerik.Web.DisableAsyncUploadHandler** key in the `appSettings` section of your web.config to **true**. You can then [create a custom handler](http://docs.telerik.>com/devtools/aspnet-ajax/controls/asyncupload/how-to/how-to-extend-the-radasyncupload-handler) with the desired level of security.
91+
>
92+
>**End of the deprecated solutions section**
16793
16894

16995
## Notes
@@ -177,6 +103,8 @@ We would like to thank Paul Taylor / Foregenix Ltd and Markus Wulftange of Code
177103

178104
# See Also
179105

106+
- [Security]({%slug general-information/security%})
107+
180108
- [Cryptographic Weakness](https://www.telerik.com/support/kb/aspnet-ajax/details/cryptographic-weakness)
181109

182110
- [Unrestricted File Upload](https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload)

0 commit comments

Comments
 (0)