diff --git a/docs/en/Best-Practices/Entity-Framework-Core-Integration.md b/docs/en/Best-Practices/Entity-Framework-Core-Integration.md index 04ddeaeba4..4db6518201 100644 --- a/docs/en/Best-Practices/Entity-Framework-Core-Integration.md +++ b/docs/en/Best-Practices/Entity-Framework-Core-Integration.md @@ -16,11 +16,13 @@ [ConnectionStringName("AbpIdentity")] public interface IIdentityDbContext : IEfCoreDbContext { - DbSet Users { get; set; } - DbSet Roles { get; set; } + DbSet Users { get; } + DbSet Roles { get; } } ```` +* **Do not** define `set;` for the properties in this interface. + ### DbContext class * **Do** inherit the `DbContext` from the `AbpDbContext` class. diff --git a/docs/en/Blob-Storing-Aliyun.md b/docs/en/Blob-Storing-Aliyun.md index 6cdebb3acc..4060e5ba26 100644 --- a/docs/en/Blob-Storing-Aliyun.md +++ b/docs/en/Blob-Storing-Aliyun.md @@ -36,7 +36,7 @@ Configure(options => aliyun.Policy = "policy"; aliyun.DurationSeconds = "expiration date"; aliyun.ContainerName = "your aliyun container name"; - aliyun.CreateContainerIfNotExists = false; + aliyun.CreateContainerIfNotExists = true; }); }); }); diff --git a/docs/en/Blob-Storing-Aws.md b/docs/en/Blob-Storing-Aws.md index 05e3caa183..aa7707e5d3 100644 --- a/docs/en/Blob-Storing-Aws.md +++ b/docs/en/Blob-Storing-Aws.md @@ -39,7 +39,7 @@ Configure(options => Aws.Policy = "policy"; Aws.DurationSeconds = "expiration date"; Aws.ContainerName = "your Aws container name"; - Aws.CreateContainerIfNotExists = false; + Aws.CreateContainerIfNotExists = true; }); }); }); diff --git a/docs/en/Blob-Storing-Azure.md b/docs/en/Blob-Storing-Azure.md index de6ed63152..99833e71c0 100644 --- a/docs/en/Blob-Storing-Azure.md +++ b/docs/en/Blob-Storing-Azure.md @@ -29,7 +29,7 @@ Configure(options => { azure.ConnectionString = "your azure connection string"; azure.ContainerName = "your azure container name"; - azure.CreateContainerIfNotExists = false; + azure.CreateContainerIfNotExists = true; }); }); }); diff --git a/docs/en/Customizing-Application-Modules-Overriding-Services.md b/docs/en/Customizing-Application-Modules-Overriding-Services.md index ab6f29816b..081b142ad7 100644 --- a/docs/en/Customizing-Application-Modules-Overriding-Services.md +++ b/docs/en/Customizing-Application-Modules-Overriding-Services.md @@ -196,12 +196,16 @@ This example replaces the `AccountController` (An API Controller defined in the **`[ExposeServices(typeof(AccountController))]` is essential** here since it registers this controller for the `AccountController` in the dependency injection system. `[Dependency(ReplaceServices = true)]` is also recommended to clear the old registration (even the ASP.NET Core DI system selects the last registered one). -In addition, The `AccountController` will be removed from [`ApplicationModel`](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.applicationmodels.applicationmodel.controllers) because it defines `ExposeServicesAttribute`. If you don't want to remove it, you can configure `AbpAspNetCoreMvcOptions`: +In addition, the `MyAccountController` will be removed from [`ApplicationModel`](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.mvc.applicationmodels.applicationmodel.controllers) because it defines `ExposeServicesAttribute`. + +If `IncludeSelf = true` is specified, i.e. `[ExposeServices(typeof(AccountController), IncludeSelf = true)]`, then `AccountController` will be removed instead. This is useful for **extending** a controller. + +If you don't want to remove either controller, you can configure `AbpAspNetCoreMvcOptions`: ```csharp Configure(options => { - options.IgnoredControllersOnModelExclusion.AddIfNotContains(typeof(AccountController)); + options.IgnoredControllersOnModelExclusion.AddIfNotContains(typeof(MyAccountController)); }); ``` diff --git a/docs/zh-Hans/Blob-Storing-Aliyun.md b/docs/zh-Hans/Blob-Storing-Aliyun.md index c8a1e68bc7..eb67fdbab5 100644 --- a/docs/zh-Hans/Blob-Storing-Aliyun.md +++ b/docs/zh-Hans/Blob-Storing-Aliyun.md @@ -36,7 +36,7 @@ Configure(options => aliyun.Policy = "policy"; aliyun.DurationSeconds = "expiration date"; aliyun.ContainerName = "your aliyun container name"; - aliyun.CreateContainerIfNotExists = false; + aliyun.CreateContainerIfNotExists = true; }); }); }); diff --git a/docs/zh-Hans/Blob-Storing-Aws.md b/docs/zh-Hans/Blob-Storing-Aws.md index 7bfb998297..fc98c5a948 100644 --- a/docs/zh-Hans/Blob-Storing-Aws.md +++ b/docs/zh-Hans/Blob-Storing-Aws.md @@ -39,7 +39,7 @@ Configure(options => Aws.Policy = "policy"; Aws.DurationSeconds = "expiration date"; Aws.ContainerName = "your Aws container name"; - Aws.CreateContainerIfNotExists = false; + Aws.CreateContainerIfNotExists = true; }); }); }); diff --git a/docs/zh-Hans/Blob-Storing-Azure.md b/docs/zh-Hans/Blob-Storing-Azure.md index 8eecc1fde3..e1ed3a6d4e 100644 --- a/docs/zh-Hans/Blob-Storing-Azure.md +++ b/docs/zh-Hans/Blob-Storing-Azure.md @@ -29,7 +29,7 @@ Configure(options => { azure.ConnectionString = "your azure connection string"; azure.ContainerName = "your azure container name"; - azure.CreateContainerIfNotExists = false; + azure.CreateContainerIfNotExists = true; }); }); }); diff --git a/framework/Volo.Abp.sln b/framework/Volo.Abp.sln index 8c2670fa27..d1288de62d 100644 --- a/framework/Volo.Abp.sln +++ b/framework/Volo.Abp.sln @@ -361,6 +361,10 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Volo.Abp.Http.Tests", "test EndProject Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Volo.Abp.EventBus.Abstractions", "src\Volo.Abp.EventBus.Abstractions\Volo.Abp.EventBus.Abstractions.csproj", "{8FDB3BF7-AD89-43F6-8DEB-C3E29B8801FE}" EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Volo.Abp.Sms.Aliyun", "src\Volo.Abp.Sms.Aliyun\Volo.Abp.Sms.Aliyun.csproj", "{ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30}" +EndProject +Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Volo.Abp.Sms.Aliyun.Tests", "test\Volo.Abp.Sms.Aliyun.Tests\Volo.Abp.Sms.Aliyun.Tests.csproj", "{DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Any CPU = Debug|Any CPU @@ -1075,6 +1079,14 @@ Global {8FDB3BF7-AD89-43F6-8DEB-C3E29B8801FE}.Debug|Any CPU.Build.0 = Debug|Any CPU {8FDB3BF7-AD89-43F6-8DEB-C3E29B8801FE}.Release|Any CPU.ActiveCfg = Release|Any CPU {8FDB3BF7-AD89-43F6-8DEB-C3E29B8801FE}.Release|Any CPU.Build.0 = Release|Any CPU + {ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30}.Debug|Any CPU.Build.0 = Debug|Any CPU + {ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30}.Release|Any CPU.ActiveCfg = Release|Any CPU + {ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30}.Release|Any CPU.Build.0 = Release|Any CPU + {DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401}.Debug|Any CPU.Build.0 = Debug|Any CPU + {DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401}.Release|Any CPU.ActiveCfg = Release|Any CPU + {DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401}.Release|Any CPU.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE @@ -1257,6 +1269,8 @@ Global {00D07595-993C-40FC-BD90-0DD6331414D3} = {447C8A77-E5F0-4538-8687-7383196D04EA} {A37BFEB5-7C57-4CDC-93B8-B5CE4BB9ACE1} = {447C8A77-E5F0-4538-8687-7383196D04EA} {8FDB3BF7-AD89-43F6-8DEB-C3E29B8801FE} = {5DF0E140-0513-4D0D-BE2E-3D4D85CD70E6} + {ACFBA3FB-18CE-4655-9D14-1F1F5C3DFC30} = {5DF0E140-0513-4D0D-BE2E-3D4D85CD70E6} + {DADEA538-3CA1-4ADE-A7E6-EF77A0CE4401} = {447C8A77-E5F0-4538-8687-7383196D04EA} EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {BB97ECF4-9A84-433F-A80B-2A3285BDD1D5} diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProvider.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProvider.cs index 1710fd5bd7..ff7f4913a8 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProvider.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProvider.cs @@ -271,6 +271,7 @@ namespace Volo.Abp.AspNetCore.Mvc actionModel.AddParameter(ParameterApiDescriptionModel.Create( parameterDescription.Name, + _options.ApiParameterNameGenerator?.Invoke(parameterDescription), matchedMethodParamName, parameterDescription.Type, parameterDescription.RouteInfo?.IsOptional ?? false, diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProviderOptions.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProviderOptions.cs index 4cd607e07a..f807efcfdf 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProviderOptions.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AspNetCoreApiDescriptionModelProviderOptions.cs @@ -2,6 +2,9 @@ using System.Linq; using System.Reflection; using System.Text; +using System.Text.Json.Serialization; +using Microsoft.AspNetCore.Mvc.ApiExplorer; +using Microsoft.AspNetCore.Mvc.ModelBinding.Metadata; using Volo.Abp.Application.Services; using Volo.Abp.AspNetCore.Mvc.Conventions; @@ -13,6 +16,8 @@ namespace Volo.Abp.AspNetCore.Mvc public Func ActionNameGenerator { get; set; } + public Func ApiParameterNameGenerator { get; set; } + public AspNetCoreApiDescriptionModelProviderOptions() { ControllerNameGenerator = (controllerType, setting) => @@ -52,6 +57,28 @@ namespace Volo.Abp.AspNetCore.Mvc return methodNameBuilder.ToString(); }; + + ApiParameterNameGenerator = (apiParameterDescription) => + { + if (apiParameterDescription.ModelMetadata is DefaultModelMetadata defaultModelMetadata) + { + var jsonPropertyNameAttribute = (System.Text.Json.Serialization.JsonPropertyNameAttribute) + defaultModelMetadata?.Attributes?.PropertyAttributes?.FirstOrDefault(x => x is System.Text.Json.Serialization.JsonPropertyNameAttribute); + if (jsonPropertyNameAttribute != null) + { + return jsonPropertyNameAttribute.Name; + } + + var jsonPropertyAttribute = (Newtonsoft.Json.JsonPropertyAttribute) + defaultModelMetadata?.Attributes?.PropertyAttributes?.FirstOrDefault(x => x is Newtonsoft.Json.JsonPropertyAttribute); + if (jsonPropertyAttribute != null) + { + return jsonPropertyAttribute.PropertyName; + } + } + + return null; + }; } } } diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Conventions/AbpServiceConvention.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Conventions/AbpServiceConvention.cs index 4d1490ec40..996e495588 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Conventions/AbpServiceConvention.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Conventions/AbpServiceConvention.cs @@ -73,7 +73,7 @@ namespace Volo.Abp.AspNetCore.Mvc.Conventions protected virtual void RemoveDuplicateControllers(ApplicationModel application) { - var derivedControllerModels = new List(); + var controllerModelsToRemove = new List(); foreach (var controllerModel in application.Controllers) { @@ -87,19 +87,42 @@ namespace Volo.Abp.AspNetCore.Mvc.Conventions continue; } + var exposeServicesAttr = ReflectionHelper.GetSingleAttributeOrDefault(controllerModel.ControllerType); + if (exposeServicesAttr.IncludeSelf) + { + var exposedControllerModels = application.Controllers + .Where(cm => exposeServicesAttr.ServiceTypes.Contains(cm.ControllerType)) + .ToArray(); + + controllerModelsToRemove.AddRange(exposedControllerModels); + Logger.LogInformation($"Removing the controller{(exposedControllerModels.Length > 1 ? "s" : "")} {exposeServicesAttr.ServiceTypes.Select(c => c.AssemblyQualifiedName).JoinAsString(", ")} from the application model since {(exposedControllerModels.Length > 1 ? "they are" : "it is")} replaced by the controller: {controllerModel.ControllerType.AssemblyQualifiedName}"); + continue; + } + var baseControllerTypes = controllerModel.ControllerType .GetBaseClasses(typeof(Controller), includeObject: false) .Where(t => !t.IsAbstract) .ToArray(); - if (baseControllerTypes.Length > 0) + if (baseControllerTypes.Length == 0) { - derivedControllerModels.Add(controllerModel); - Logger.LogInformation($"Removing the controller {controllerModel.ControllerType.AssemblyQualifiedName} from the application model since it replaces the controller(s): {baseControllerTypes.Select(c => c.AssemblyQualifiedName).JoinAsString(", ")}"); + continue; } + + var baseControllerModels = application.Controllers + .Where(cm => baseControllerTypes.Contains(cm.ControllerType)) + .ToArray(); + + if (baseControllerModels.Length == 0) + { + continue; + } + + controllerModelsToRemove.Add(controllerModel); + Logger.LogInformation($"Removing the controller {controllerModel.ControllerType.AssemblyQualifiedName} from the application model since it replaces the controller(s): {baseControllerTypes.Select(c => c.AssemblyQualifiedName).JoinAsString(", ")}"); } - application.Controllers.RemoveAll(derivedControllerModels); + application.Controllers.RemoveAll(controllerModelsToRemove); } protected virtual void ConfigureRemoteService(ControllerModel controller, [CanBeNull] ConventionalControllerSetting configuration) diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowActionFilter.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowActionFilter.cs index 95a961b814..0512e28f7a 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowActionFilter.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowActionFilter.cs @@ -50,7 +50,6 @@ namespace Volo.Abp.AspNetCore.Mvc.Uow return; } - //Begin a new, independent unit of work using (var uow = unitOfWorkManager.Begin(options)) { var result = await next(); @@ -58,6 +57,10 @@ namespace Volo.Abp.AspNetCore.Mvc.Uow { await uow.CompleteAsync(context.HttpContext.RequestAborted); } + else + { + await uow.RollbackAsync(context.HttpContext.RequestAborted); + } } } diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowPageFilter.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowPageFilter.cs index 30c713940f..d808053592 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowPageFilter.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Uow/AbpUowPageFilter.cs @@ -55,7 +55,6 @@ namespace Volo.Abp.AspNetCore.Mvc.Uow return; } - //Begin a new, independent unit of work using (var uow = unitOfWorkManager.Begin(options)) { var result = await next(); @@ -63,6 +62,10 @@ namespace Volo.Abp.AspNetCore.Mvc.Uow { await uow.CompleteAsync(context.HttpContext.RequestAborted); } + else + { + await uow.RollbackAsync(context.HttpContext.RequestAborted); + } } } diff --git a/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/Builder/AbpApplicationBuilderExtensions.cs b/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/Builder/AbpApplicationBuilderExtensions.cs index 568ecfef7b..a409355ef0 100644 --- a/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/Builder/AbpApplicationBuilderExtensions.cs +++ b/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/Builder/AbpApplicationBuilderExtensions.cs @@ -6,6 +6,7 @@ using Microsoft.Extensions.Hosting; using Volo.Abp; using Volo.Abp.AspNetCore.Auditing; using Volo.Abp.AspNetCore.ExceptionHandling; +using Volo.Abp.AspNetCore.Security; using Volo.Abp.AspNetCore.Security.Claims; using Volo.Abp.AspNetCore.Tracing; using Volo.Abp.AspNetCore.Uow; @@ -82,5 +83,10 @@ namespace Microsoft.AspNetCore.Builder { return app.UseMiddleware(); } + + public static IApplicationBuilder UseAbpSecurityHeaders(this IApplicationBuilder app) + { + return app.UseMiddleware(); + } } } diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs new file mode 100644 index 0000000000..28b0f3a48e --- /dev/null +++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs @@ -0,0 +1,30 @@ +using System.Collections.Generic; +using System.Threading.Tasks; +using Microsoft.AspNetCore.Http; +using Microsoft.Extensions.Primitives; +using Volo.Abp.DependencyInjection; + +namespace Volo.Abp.AspNetCore.Security +{ + public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency + { + public async Task InvokeAsync(HttpContext context, RequestDelegate next) + { + /*X-Content-Type-Options header tells the browser to not try and “guess” what a mimetype of a resource might be, and to just take what mimetype the server has returned as fact.*/ + AddHeaderIfNotExists(context, "X-Content-Type-Options", "nosniff"); + + /*X-XSS-Protection is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks*/ + AddHeaderIfNotExists(context, "X-XSS-Protection", "1; mode=block"); + + /*The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a ,