Upgrade to latest dependencies: Castle, NHibernate, AutoFac

[orchardbot]

attilah created: https://orchard.codeplex.com/workitem/17458

The above components are very outdated and new versions are having more mature features and these are very-very-very core components for the system, so an upgrade should be a good thing for 1.1 MIX release.

I tried it, but a simple binary upgrade did not help and I'm not familiar with these, one-by-one update is almost impossible...

Maybe a Castle + AutoFac and a NHibernate upgrade after is doable.

Currently in the Lib folder more version of the Castle binaries are present, because different components have different version dependencies, which can cause problems.

Plz vote this issue up to get an owner and a schedule for 1.1!

[orchardbot]

rpaquay commented:

Unfortunately, we won't have time to do this for 1.1. The changes are too deep. We created a separate branch with the "work in progress"

[orchardbot]

@andrerod commented:

This is currently working under full trust. Work required to make it work under medium trust due to limitations on the libraries used specifically nhibernate and fluent nhibernate.

[orchardbot]

@bleroy commented:

Quick comment on this: we might want to poll the community on how important medium trust still is today. I would have personally no issue in making 2.0 full trust only.

[orchardbot]

JLedel commented:

In which branch are the components updated? "Upgraded Libs"?

[orchardbot]

codepunkt commented:

Hi,

I personally/professionally think it's very important to keep Orchard working under medium trust. A lot of sites are running in a shared hosting environment and not everybody has the resources to upgrade to a dedicated system. I was looking for a long time to find such a clean .NET codebase and with Orchard I believe we have now a very good counterpart to PHP systems. PHP CMS systems are running very cheap on most shared hosts and if Orchard wants to get a wide user base it should include small fishes too.

Just my 2 cents.

Thanks again for such a great system.

Any comments are most welcome.

Regards, Johann

[orchardbot]

@bleroy commented:

A lot of shared hosting plans now run full trust (even cheap ones), and it will continue on that trend as hosters realize that medium trust is a lot of trouble for no real security benefit.

[orchardbot]

codepunkt commented:

Thanks for your feedback. I have never thought so far but it might be true. Perhaps this discussion should be moved to a different thread as it would be great to involve the whole community and second I don't want to hijack this thread with another topic ;-). But just shortly, how would a hoster protect each others customers data when running in full trust?

Thanks again!

[orchardbot]

@bleroy commented:

Medium trust is not designed as an isolation method. AppDomains are.

[orchardbot]

codepunkt commented:

Sorry, for the delay. Wanted to wait what my hosting provider has to say and they told me that AppDomains are not configurable by the hoster but by the developer/web designer. And therefore for security reasons they have to asume that AppDomains are not used in their customers ASP.NET applications... Please feel free to correct me ;-).

Regards, Johann

[orchardbot]

@bleroy commented:

I meant app pools, sorry http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/67e39bd8-317e-4cf6-b675-6431d4425248.mspx?mfr=true

[orchardbot]

Damiano commented:

Please make it to always work in Medium Trust.

I agree with "codepunkt" comment.

Microsoft managed to make SQLCE 4.0 working in medium trust and Orchard should do the same.

Today I still having problem to run Orchard in shared hosted provider that have also more restricted custom policy.