From acb596d38cce409e54bfd9b63738601e8e83c22b Mon Sep 17 00:00:00 2001 From: liangshiwei Date: Mon, 21 Dec 2020 21:05:25 +0800 Subject: [PATCH] Added RedirectAlowedUrls --- .../Mvc/UI/RazorPages/AbpPageModel.cs | 41 +++++++++++++++++++ .../Volo.Abp.AspNetCore.Mvc.csproj | 1 + .../AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs | 3 +- .../Volo/Abp/AspNetCore/Mvc/AbpController.cs | 41 +++++++++++++++++++ .../ChallengeAccountController.cs | 37 ----------------- .../Abp/Ui/Navigation/Urls/AppUrlOptions.cs | 7 +++- .../Abp/Ui/Navigation/Urls/AppUrlProvider.cs | 6 +++ .../Abp/Ui/Navigation/Urls/IAppUrlProvider.cs | 2 + .../Pages/Account/AccountPageModel.cs | 37 ----------------- .../MyProjectNameHttpApiHostModule.cs | 1 + .../appsettings.json | 3 +- .../MyProjectNameIdentityServerModule.cs | 1 + .../appsettings.json | 3 +- 13 files changed, 105 insertions(+), 78 deletions(-) diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI/Volo/Abp/AspNetCore/Mvc/UI/RazorPages/AbpPageModel.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI/Volo/Abp/AspNetCore/Mvc/UI/RazorPages/AbpPageModel.cs index 4303c698fe..fcbe9af59c 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI/Volo/Abp/AspNetCore/Mvc/UI/RazorPages/AbpPageModel.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI/Volo/Abp/AspNetCore/Mvc/UI/RazorPages/AbpPageModel.cs @@ -16,6 +16,7 @@ using Volo.Abp.MultiTenancy; using Volo.Abp.ObjectMapping; using Volo.Abp.Settings; using Volo.Abp.Timing; +using Volo.Abp.UI.Navigation.Urls; using Volo.Abp.Uow; using Volo.Abp.Users; @@ -125,6 +126,9 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.RazorPages protected ILogger Logger => _lazyLogger.Value; private Lazy _lazyLogger => new Lazy(() => LoggerFactory?.CreateLogger(GetType().FullName) ?? NullLogger.Instance, true); + protected IAppUrlProvider AppUrlProvider => LazyGetRequiredService(ref _appUrlProvider); + private IAppUrlProvider _appUrlProvider; + protected virtual NoContentResult NoContent() //TODO: Is that true to return empty result like that? { return new NoContentResult(); @@ -165,5 +169,42 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.RazorPages return localizer; } + + protected RedirectResult RedirectSafely(string returnUrl, string returnUrlHash = null) + { + return Redirect(GetRedirectUrl(returnUrl, returnUrlHash)); + } + + protected virtual string GetRedirectUrl(string returnUrl, string returnUrlHash = null) + { + returnUrl = NormalizeReturnUrl(returnUrl); + + if (!returnUrlHash.IsNullOrWhiteSpace()) + { + returnUrl = returnUrl + returnUrlHash; + } + + return returnUrl; + } + + private string NormalizeReturnUrl(string returnUrl) + { + if (returnUrl.IsNullOrEmpty()) + { + return GetAppHomeUrl(); + } + + if (Url.IsLocalUrl(returnUrl) || AppUrlProvider.IsRedirectAllowedUrl(returnUrl)) + { + return returnUrl; + } + + return GetAppHomeUrl(); + } + + protected virtual string GetAppHomeUrl() + { + return "~/"; //TODO: ??? + } } } diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo.Abp.AspNetCore.Mvc.csproj b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo.Abp.AspNetCore.Mvc.csproj index 53e3c7f503..1f2211c14f 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo.Abp.AspNetCore.Mvc.csproj +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo.Abp.AspNetCore.Mvc.csproj @@ -23,6 +23,7 @@ + diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs index 61d73cb48b..e5edd9662d 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs @@ -39,6 +39,7 @@ using Volo.Abp.Json; using Volo.Abp.Localization; using Volo.Abp.Modularity; using Volo.Abp.UI; +using Volo.Abp.UI.Navigation; namespace Volo.Abp.AspNetCore.Mvc { @@ -47,7 +48,7 @@ namespace Volo.Abp.AspNetCore.Mvc typeof(AbpLocalizationModule), typeof(AbpApiVersioningAbstractionsModule), typeof(AbpAspNetCoreMvcContractsModule), - typeof(AbpUiModule), + typeof(AbpUiNavigationModule), typeof(AbpGlobalFeaturesModule) )] public class AbpAspNetCoreMvcModule : AbpModule diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpController.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpController.cs index 645e13b026..f83353092e 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpController.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpController.cs @@ -14,6 +14,7 @@ using Volo.Abp.Localization; using Volo.Abp.MultiTenancy; using Volo.Abp.ObjectMapping; using Volo.Abp.Timing; +using Volo.Abp.UI.Navigation.Urls; using Volo.Abp.Uow; using Volo.Abp.Users; @@ -115,6 +116,9 @@ namespace Volo.Abp.AspNetCore.Mvc } private IStringLocalizer _localizer; + protected IAppUrlProvider AppUrlProvider => LazyGetRequiredService(ref _appUrlProvider); + private IAppUrlProvider _appUrlProvider; + protected Type LocalizationResource { get => _localizationResource; @@ -148,5 +152,42 @@ namespace Volo.Abp.AspNetCore.Mvc return localizer; } + + protected RedirectResult RedirectSafely(string returnUrl, string returnUrlHash = null) + { + return Redirect(GetRedirectUrl(returnUrl, returnUrlHash)); + } + + private string GetRedirectUrl(string returnUrl, string returnUrlHash = null) + { + returnUrl = NormalizeReturnUrl(returnUrl); + + if (!returnUrlHash.IsNullOrWhiteSpace()) + { + returnUrl = returnUrl + returnUrlHash; + } + + return returnUrl; + } + + private string NormalizeReturnUrl(string returnUrl) + { + if (returnUrl.IsNullOrEmpty()) + { + return GetAppHomeUrl(); + } + + if (Url.IsLocalUrl(returnUrl) || AppUrlProvider.IsRedirectAllowedUrl(returnUrl)) + { + return returnUrl; + } + + return GetAppHomeUrl(); + } + + protected virtual string GetAppHomeUrl() + { + return "~/"; + } } } diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Authentication/ChallengeAccountController.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Authentication/ChallengeAccountController.cs index 781866232b..d01bac2e81 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Authentication/ChallengeAccountController.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/Authentication/ChallengeAccountController.cs @@ -66,42 +66,5 @@ namespace Volo.Abp.AspNetCore.Mvc.Authentication return NoContent(); } - - protected RedirectResult RedirectSafely(string returnUrl, string returnUrlHash = null) - { - return Redirect(GetRedirectUrl(returnUrl, returnUrlHash)); - } - - private string GetRedirectUrl(string returnUrl, string returnUrlHash = null) - { - returnUrl = NormalizeReturnUrl(returnUrl); - - if (!returnUrlHash.IsNullOrWhiteSpace()) - { - returnUrl = returnUrl + returnUrlHash; - } - - return returnUrl; - } - - private string NormalizeReturnUrl(string returnUrl) - { - if (returnUrl.IsNullOrEmpty()) - { - return GetAppHomeUrl(); - } - - if (Url.IsLocalUrl(returnUrl)) - { - return returnUrl; - } - - return GetAppHomeUrl(); - } - - protected virtual string GetAppHomeUrl() - { - return "~/"; - } } } diff --git a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlOptions.cs b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlOptions.cs index ebfbbedcd5..79a1afba14 100644 --- a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlOptions.cs +++ b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlOptions.cs @@ -1,12 +1,17 @@ -namespace Volo.Abp.UI.Navigation.Urls +using System.Collections.Generic; + +namespace Volo.Abp.UI.Navigation.Urls { public class AppUrlOptions { public ApplicationUrlDictionary Applications { get; } + public List RedirectAllowedUrls { get; } + public AppUrlOptions() { Applications = new ApplicationUrlDictionary(); + RedirectAllowedUrls = new List(); } } } diff --git a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlProvider.cs b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlProvider.cs index 912621c424..62212c2206 100644 --- a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlProvider.cs +++ b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/AppUrlProvider.cs @@ -1,5 +1,6 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Threading.Tasks; using Microsoft.Extensions.Options; using Volo.Abp.DependencyInjection; @@ -36,6 +37,11 @@ namespace Volo.Abp.UI.Navigation.Urls ); } + public bool IsRedirectAllowedUrl(string url) + { + return Options.RedirectAllowedUrls.Any(url.Contains); + } + protected virtual Task GetConfiguredUrl(string appName, string urlName) { var app = Options.Applications[appName]; diff --git a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/IAppUrlProvider.cs b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/IAppUrlProvider.cs index 37fe1ea0de..61b6fc2bac 100644 --- a/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/IAppUrlProvider.cs +++ b/framework/src/Volo.Abp.UI.Navigation/Volo/Abp/Ui/Navigation/Urls/IAppUrlProvider.cs @@ -6,5 +6,7 @@ namespace Volo.Abp.UI.Navigation.Urls public interface IAppUrlProvider { Task GetUrlAsync([NotNull] string appName, [CanBeNull] string urlName = null); + + bool IsRedirectAllowedUrl(string url); } } diff --git a/modules/account/src/Volo.Abp.Account.Web/Pages/Account/AccountPageModel.cs b/modules/account/src/Volo.Abp.Account.Web/Pages/Account/AccountPageModel.cs index 36564f9af8..3e016c8bb5 100644 --- a/modules/account/src/Volo.Abp.Account.Web/Pages/Account/AccountPageModel.cs +++ b/modules/account/src/Volo.Abp.Account.Web/Pages/Account/AccountPageModel.cs @@ -25,11 +25,6 @@ namespace Volo.Abp.Account.Web.Pages.Account ObjectMapperContext = typeof(AbpAccountWebModule); } - protected virtual RedirectResult RedirectSafely(string returnUrl, string returnUrlHash = null) - { - return Redirect(GetRedirectUrl(returnUrl, returnUrlHash)); - } - protected virtual void CheckIdentityErrors(IdentityResult identityResult) { if (!identityResult.Succeeded) @@ -40,33 +35,6 @@ namespace Volo.Abp.Account.Web.Pages.Account //identityResult.CheckErrors(LocalizationManager); //TODO: Get from old Abp } - protected virtual string GetRedirectUrl(string returnUrl, string returnUrlHash = null) - { - returnUrl = NormalizeReturnUrl(returnUrl); - - if (!returnUrlHash.IsNullOrWhiteSpace()) - { - returnUrl = returnUrl + returnUrlHash; - } - - return returnUrl; - } - - protected virtual string NormalizeReturnUrl(string returnUrl) - { - if (returnUrl.IsNullOrEmpty()) - { - return GetAppHomeUrl(); - } - - if (Url.IsLocalUrl(returnUrl)) - { - return returnUrl; - } - - return GetAppHomeUrl(); - } - protected virtual void CheckCurrentTenant(Guid? tenantId) { if (CurrentTenant.Id != tenantId) @@ -74,10 +42,5 @@ namespace Volo.Abp.Account.Web.Pages.Account throw new ApplicationException($"Current tenant is different than given tenant. CurrentTenant.Id: {CurrentTenant.Id}, given tenantId: {tenantId}"); } } - - protected virtual string GetAppHomeUrl() - { - return "~/"; //TODO: ??? - } } } diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs index 9551cad310..39cedbb06a 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/MyProjectNameHttpApiHostModule.cs @@ -77,6 +77,7 @@ namespace MyCompanyName.MyProjectName Configure(options => { options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"]; + options.RedirectAllowedUrls.AddRange(configuration["App:RedirectAllowedUrls"].Split(',')); }); } diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/appsettings.json index e62c32aa0c..795753ec9d 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/appsettings.json +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.HostWithIds/appsettings.json @@ -1,7 +1,8 @@ { "App": { "SelfUrl": "https://localhost:44305", - "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200,https://localhost:44307" + "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200,https://localhost:44307", + "RedirectAllowedUrls": "http://localhost:4200,https://localhost:44307" }, "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True;MultipleActiveResultSets=true" diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs index a5013823ac..07db333488 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs @@ -112,6 +112,7 @@ namespace MyCompanyName.MyProjectName Configure(options => { options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"]; + options.RedirectAllowedUrls.AddRange(configuration["App:RedirectAllowedUrls"].Split(',')); }); Configure(options => diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json index e9152eb6ad..c7101f92ed 100644 --- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json +++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json @@ -1,7 +1,8 @@ { "App": { "SelfUrl": "https://localhost:44301", - "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200,https://localhost:44307,https://localhost:44300" + "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200,https://localhost:44307,https://localhost:44300", + "RedirectAllowedUrls": "http://localhost:4200,https://localhost:44307" }, "ConnectionStrings": { "Default": "Server=(LocalDb)\\MSSQLLocalDB;Database=MyProjectName;Trusted_Connection=True;MultipleActiveResultSets=true"