Merge pull request #11570 from umbraco/v9/feature/merge_v9_contrib_03-11-2021

V9: Merge `v9/contrib` 03-11-2021

Author: bergmania

.github/CONTRIBUTING.md

@@ -72,10 +72,10 @@ Great question! The short version goes like this:
 
   ![Clone the fork](img/clonefork.png)
 
-  * **Switch to the correct branch** - switch to the `v8/contrib` branch
+  * **Switch to the correct branch** - switch to the `v9/contrib` branch
   * **Build** - build your fork of Umbraco locally as described in [building Umbraco from source code](BUILD.md)
   * **Change** - make your changes, experiment, have fun, explore and learn, and don't be afraid. We welcome all contributions and will [happily give feedback](#questions)
-  * **Commit** - done? Yay! 🎉 **Important:** create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case `12345`. When you have a branch, commit your changes. Don't commit to `v8/contrib`, create a new branch first.
+  * **Commit** - done? Yay! 🎉 **Important:** create a new branch now and name it after the issue you're fixing, we usually follow the format: `temp-12345`. This means it's a temporary branch for the particular issue you're working on, in this case `12345`. When you have a branch, commit your changes. Don't commit to `v9/contrib`, create a new branch first.
   * **Push** - great, now you can push the changes up to your fork on GitHub
   * **Create pull request** - exciting! You're ready to show us your changes (or not quite ready, you just need some feedback to progress - you can now make use of GitHub's draft pull request status, detailed [here](https://github.blog/2019-02-14-introducing-draft-pull-requests/)). GitHub has picked up on the new branch you've pushed and will offer to create a Pull Request. Click that green button and away you go.
 
@@ -173,7 +173,7 @@ To find the general areas for something you're looking to fix or improve, have a
 
 ### Which branch should I target for my contributions?
 
-We like to use [Gitflow as much as possible](https://jeffkreeftmeijer.com/git-flow/), but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to something, usually `v8/contrib`. If you are working on v8, this is the branch you should be targetting. For v7 contributions, please target 'v7/dev'.
+We like to use [Gitflow as much as possible](https://jeffkreeftmeijer.com/git-flow/), but don't worry if you are not familiar with it. The most important thing you need to know is that when you fork the Umbraco repository, the default branch is set to something, usually `v9/contrib`. If you are working on v9, this is the branch you should be targetting. For v8 contributions, please target 'v8/contrib'
 
 Please note: we are no longer accepting features for v7 but will continue to merge bug fixes as and when they arise.
 
@@ -199,10 +199,10 @@ Then when you want to get the changes from the main repository:
 
 ```
 git fetch upstream
-git rebase upstream/v8/contrib
+git rebase upstream/v9/contrib
 ```
 
-In this command we're syncing with the `v8/contrib` branch, but you can of course choose another one if needed.
+In this command we're syncing with the `v9/contrib` branch, but you can of course choose another one if needed.
 
 (More info on how this works: [http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated](http://robots.thoughtbot.com/post/5133345960/keeping-a-git-fork-updated))
 

.vscode/launch.json

@@ -14,6 +14,7 @@
             "args": [],
             "cwd": "${workspaceFolder}/src/Umbraco.Web.UI",
             "stopAtEntry": false,
+            "requireExactSource": false,
             // Enable launching a web browser when ASP.NET Core starts. For more information: https://aka.ms/VSCode-CS-LaunchJson-WebBrowser
             "serverReadyAction": {
                 "action": "openExternally",

NuGet.Config

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using System;
@@ -20,39 +20,45 @@ namespace Umbraco.Cms.Core.HealthChecks.Checks.Security
     public abstract class BaseHttpHeaderCheck : HealthCheck
     {
         private readonly IHostingEnvironment _hostingEnvironment;
+        private readonly ILocalizedTextService _textService;
         private readonly string _header;
-        private readonly string _value;
         private readonly string _localizedTextPrefix;
         private readonly bool _metaTagOptionAvailable;
         private static HttpClient s_httpClient;
 
+        [Obsolete("Use ctor without value.")]
+        protected BaseHttpHeaderCheck(
+            IHostingEnvironment hostingEnvironment,
+            ILocalizedTextService textService,
+            string header,
+            string value,
+            string localizedTextPrefix,
+            bool metaTagOptionAvailable) :this(hostingEnvironment, textService, header, localizedTextPrefix, metaTagOptionAvailable)
+        {
+
+        }
+
+        [Obsolete("Save ILocalizedTextService in a field on the super class instead of using this")]
+        protected ILocalizedTextService LocalizedTextService => _textService;
         /// <summary>
         /// Initializes a new instance of the <see cref="BaseHttpHeaderCheck"/> class.
         /// </summary>
         protected BaseHttpHeaderCheck(
             IHostingEnvironment hostingEnvironment,
             ILocalizedTextService textService,
             string header,
-            string value,
             string localizedTextPrefix,
             bool metaTagOptionAvailable)
         {
-            LocalizedTextService = textService ?? throw new ArgumentNullException(nameof(textService));
+            _textService = textService ?? throw new ArgumentNullException(nameof(textService));
             _hostingEnvironment = hostingEnvironment;
             _header = header;
-            _value = value;
             _localizedTextPrefix = localizedTextPrefix;
             _metaTagOptionAvailable = metaTagOptionAvailable;
         }
 
         private static HttpClient HttpClient => s_httpClient ??= new HttpClient();
 
-
-        /// <summary>
-        /// Gets the localized text service.
-        /// </summary>
-        protected ILocalizedTextService LocalizedTextService { get; }
-
         /// <summary>
         /// Gets a link to an external read more page.
         /// </summary>
@@ -95,12 +101,12 @@ protected async Task<HealthCheckStatus> CheckForHeader()
                 }
 
                 message = success
-                    ? LocalizedTextService.Localize($"healthcheck", $"{_localizedTextPrefix}CheckHeaderFound")
-                    : LocalizedTextService.Localize($"healthcheck", $"{_localizedTextPrefix}CheckHeaderNotFound");
+                    ? _textService.Localize($"healthcheck", $"{_localizedTextPrefix}CheckHeaderFound")
+                    : _textService.Localize($"healthcheck", $"{_localizedTextPrefix}CheckHeaderNotFound");
             }
             catch (Exception ex)
             {
-                message = LocalizedTextService.Localize("healthcheck","healthCheckInvalidUrl", new[] { url.ToString(), ex.Message });
+                message = _textService.Localize("healthcheck","healthCheckInvalidUrl", new[] { url.ToString(), ex.Message });
             }
 
             return

src/Umbraco.Core/HealthChecks/Checks/Security/BaseHttpHeaderCheck.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using Umbraco.Cms.Core.Hosting;
@@ -20,7 +20,7 @@ public class ClickJackingCheck : BaseHttpHeaderCheck
         /// Initializes a new instance of the <see cref="ClickJackingCheck"/> class.
         /// </summary>
         public ClickJackingCheck(IHostingEnvironment hostingEnvironment, ILocalizedTextService textService)
-            : base(hostingEnvironment, textService, "X-Frame-Options", "sameorigin", "clickJacking", true)
+            : base(hostingEnvironment, textService, "X-Frame-Options", "clickJacking", true)
         {
         }
 

src/Umbraco.Core/HealthChecks/Checks/Security/ClickJackingCheck.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using System;
@@ -53,7 +53,7 @@ private async Task<HealthCheckStatus> CheckForHeaders()
         {
             string message;
             var success = false;
-            var url = _hostingEnvironment.ApplicationMainUrl.GetLeftPart(UriPartial.Authority);;
+            var url = _hostingEnvironment.ApplicationMainUrl.GetLeftPart(UriPartial.Authority);
 
             // Access the site home page and check for the headers
             var request = new HttpRequestMessage(HttpMethod.Head, url);
@@ -65,7 +65,7 @@ private async Task<HealthCheckStatus> CheckForHeaders()
                 var headersToCheckFor = new List<string> {"Server", "X-Powered-By", "X-AspNet-Version", "X-AspNetMvc-Version" };
 
                 // Ignore if server header is present and it's set to cloudflare
-                if (allHeaders.InvariantContains("Server") && response.Headers.TryGetValues("Server", out var serverHeaders) && serverHeaders.ToString().InvariantEquals("cloudflare"))
+                if (allHeaders.InvariantContains("Server") && response.Headers.TryGetValues("Server", out var serverHeaders) && serverHeaders.FirstOrDefault().InvariantEquals("cloudflare"))
                 {
                     headersToCheckFor.Remove("Server");
                 }

src/Umbraco.Core/HealthChecks/Checks/Security/ExcessiveHeadersCheck.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using Umbraco.Cms.Core.Hosting;
@@ -27,7 +27,7 @@ public class HstsCheck : BaseHttpHeaderCheck
         /// but then you should include subdomains and I wouldn't suggest to do that for Umbraco-sites.
         /// </remarks>
         public HstsCheck(IHostingEnvironment hostingEnvironment, ILocalizedTextService textService)
-            : base(hostingEnvironment, textService, "Strict-Transport-Security", "max-age=10886400", "hSTS", true)
+            : base(hostingEnvironment, textService, "Strict-Transport-Security", "hSTS", true)
         {
         }
 

src/Umbraco.Core/HealthChecks/Checks/Security/HstsCheck.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using Umbraco.Cms.Core.Hosting;
@@ -20,7 +20,7 @@ public class NoSniffCheck : BaseHttpHeaderCheck
         /// Initializes a new instance of the <see cref="NoSniffCheck"/> class.
         /// </summary>
         public NoSniffCheck(IHostingEnvironment hostingEnvironment, ILocalizedTextService textService)
-            : base(hostingEnvironment, textService, "X-Content-Type-Options", "nosniff", "noSniff", false)
+            : base(hostingEnvironment, textService, "X-Content-Type-Options", "noSniff", false)
         {
         }
 

src/Umbraco.Core/HealthChecks/Checks/Security/NoSniffCheck.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Umbraco.
+// Copyright (c) Umbraco.
 // See LICENSE for more details.
 
 using Umbraco.Cms.Core.Hosting;
@@ -27,7 +27,7 @@ public class XssProtectionCheck : BaseHttpHeaderCheck
         /// but then you should include subdomains and I wouldn't suggest to do that for Umbraco-sites.
         /// </remarks>
         public XssProtectionCheck(IHostingEnvironment hostingEnvironment, ILocalizedTextService textService)
-            : base(hostingEnvironment, textService, "X-XSS-Protection", "1; mode=block", "xssProtection", true)
+            : base(hostingEnvironment, textService, "X-XSS-Protection", "xssProtection", true)
         {
         }
 

src/Umbraco.Core/HealthChecks/Checks/Security/XssProtectionCheck.cs

@@ -0,0 +1,62 @@
+using System.Text;
+using Umbraco.Extensions;
+
+namespace Umbraco.Cms.Core.IO
+{
+    public class DefaultViewContentProvider : IDefaultViewContentProvider
+    {
+        public string GetDefaultFileContent(string layoutPageAlias = null, string modelClassName = null, string modelNamespace = null, string modelNamespaceAlias = null)
+        {
+            var content = new StringBuilder();
+
+            if (string.IsNullOrWhiteSpace(modelNamespaceAlias))
+                modelNamespaceAlias = "ContentModels";
+
+            // either
+            // @inherits Umbraco.Web.Mvc.UmbracoViewPage
+            // @inherits Umbraco.Web.Mvc.UmbracoViewPage<ModelClass>
+            content.AppendLine("@using Umbraco.Cms.Web.Common.PublishedModels;");
+            content.Append("@inherits Umbraco.Cms.Web.Common.Views.UmbracoViewPage");
+            if (modelClassName.IsNullOrWhiteSpace() == false)
+            {
+                content.Append("<");
+                if (modelNamespace.IsNullOrWhiteSpace() == false)
+                {
+                    content.Append(modelNamespaceAlias);
+                    content.Append(".");
+                }
+                content.Append(modelClassName);
+                content.Append(">");
+            }
+            content.Append("\r\n");
+
+            // if required, add
+            // @using ContentModels = ModelNamespace;
+            if (modelClassName.IsNullOrWhiteSpace() == false && modelNamespace.IsNullOrWhiteSpace() == false)
+            {
+                content.Append("@using ");
+                content.Append(modelNamespaceAlias);
+                content.Append(" = ");
+                content.Append(modelNamespace);
+                content.Append(";\r\n");
+            }
+
+            // either
+            // Layout = null;
+            // Layout = "layoutPage.cshtml";
+            content.Append("@{\r\n\tLayout = ");
+            if (layoutPageAlias.IsNullOrWhiteSpace())
+            {
+                content.Append("null");
+            }
+            else
+            {
+                content.Append("\"");
+                content.Append(layoutPageAlias);
+                content.Append(".cshtml\"");
+            }
+            content.Append(";\r\n}");
+            return content.ToString();
+        }
+    }
+}