search

thecogworks / Cogworks.SiteLock

A security package for Umbraco 7. Lock down an Umbraco website from viewers. Only users who are logged into the backoffice can see the public website.
MIT License
10 stars 5 forks source link

ModelsBuilder tool login #3

Closed emmagarland closed 6 years ago

emmagarland commented 7 years ago

Hi @AnthonyCogworks

Thanks for this package, it is a great idea especially for UAT environments.

I've installed via nuget and Umbraco, and I've set the SiteLock.config.

Firstly, I just added the customError status code 403 to point to the HTML file in the web.config, is that what you recommend?

Secondly, I am getting an issue using the ModelsBuilder Visual Studio add-on locally (in VS 2017), which I have been using to generate models in a separate Data project. This tool authenticates with Umbraco after doing a version check to the requested URL, but this check fails due to the 403.

I believe the URL requested initially is this (although it might not be the only step):

<b> Requested URL: </b>/Umbraco/BackOffice/ModelsBuilder/ModelsBuilderApi/ValidateClientVersion<br><br> I tried to temporarily resolved this by adding to the RequestHelper.cs line 14:

if (absolutePathLowered == "/umbraco/default" || absolutePathLowered == "/umbraco/backOffice/modelsbuilder/modelsbuilderapi/validateclientversion")

This didn't work so I am just doing to switch off locally for now, I don't know of any ill-effects this code would have in terms of logging in, but thought I'd flag this anyway in case anyone else gets the same issue. I think its because of the authentication used in the tool to login to the back-office perhaps?

Its not a big issue for me as I can just keep it switched off on localhost, but thought I'd raise it.

Thanks again!

Emma

AnthonyCogworks commented 7 years ago

Hi Emma

Yes you are right with the web.config.

Regarding the path you want to ignore...

That code probably didn't work because you might have needed to use Contains(.. ).

However you don't even need to do this as SiteLock has an ignoredPaths setting in the SiteLock.config. It is a regex.

emmagarland commented 7 years ago

Thanks @anthonycogworks, weirdly I did try the ignored paths but didn't work out. I'll try some more next week but just wanted to check if you'd heard of this yet. Cheers for the reply re web.config! Emma