Merge pull request #3720 from abpframework/Cotur/Blogging

Blogging Module - Unwanted Exception Suppressing

modules/blogging/src/Volo.Blogging.Application/Volo/Blogging/Blogs/BlogAppService.cs

@@ -1,7 +1,7 @@
-using System;
+using Microsoft.AspNetCore.Authorization;
+using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.Authorization;
 using Volo.Abp.Application.Dtos;
 using Volo.Abp.Domain.Entities;
 using Volo.Blogging.Blogs.Dtos;

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Detail.cshtml.cs

@@ -8,6 +8,7 @@ using Volo.Blogging.Blogs;
 using Volo.Blogging.Blogs.Dtos;
 using Volo.Blogging.Comments;
 using Volo.Blogging.Comments.Dtos;
+using Volo.Blogging.Pages.Blogs.Shared.Helpers;
 using Volo.Blogging.Posts;
 
 namespace Volo.Blogging.Pages.Blog.Posts
@@ -48,6 +49,11 @@ namespace Volo.Blogging.Pages.Blog.Posts
 
         public virtual async Task<IActionResult> OnGetAsync()
         {
+            if (BlogNameControlHelper.IsProhibitedFileFormatName(BlogShortName))
+            {
+                return NotFound();
+            }
+
             await GetData();
 
             return Page();

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Edit.cshtml.cs

@@ -7,6 +7,7 @@ using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Volo.Abp.AspNetCore.Mvc.UI.RazorPages;
 using Volo.Blogging.Blogs;
+using Volo.Blogging.Pages.Blogs.Shared.Helpers;
 using Volo.Blogging.Posts;
 
 namespace Volo.Blogging.Pages.Blog.Posts
@@ -39,6 +40,10 @@ namespace Volo.Blogging.Pages.Blog.Posts
             {
                 return Redirect("/");
             }
+            if (BlogNameControlHelper.IsProhibitedFileFormatName(BlogShortName))
+            {
+                return NotFound();
+            }
 
             var postDto = await _postAppService.GetAsync(new Guid(PostId));
             Post = ObjectMapper.Map<PostWithDetailsDto, EditPostViewModel>(postDto);

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/Index.cshtml.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Mvc;
 using Volo.Abp.AspNetCore.Mvc.UI.RazorPages;
 using Volo.Blogging.Blogs;
 using Volo.Blogging.Blogs.Dtos;
+using Volo.Blogging.Pages.Blogs.Shared.Helpers;
 using Volo.Blogging.Posts;
 using Volo.Blogging.Tagging;
 using Volo.Blogging.Tagging.Dtos;
@@ -37,6 +38,11 @@ namespace Volo.Blogging.Pages.Blog.Posts
 
         public virtual async Task<ActionResult> OnGetAsync()
         {
+            if (BlogNameControlHelper.IsProhibitedFileFormatName(BlogShortName))
+            {
+                return NotFound();
+            }
+
             Blog = await _blogAppService.GetByShortNameAsync(BlogShortName);
             Posts = (await _postAppService.GetListByBlogIdAndTagName(Blog.Id, TagName)).Items;
             PopularTags = (await _tagAppService.GetPopularTags(Blog.Id, new GetPopularTagsInput {ResultCount = 10, MinimumPostCount = 2}));

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Posts/New.cshtml.cs

@@ -8,6 +8,7 @@ using Microsoft.Extensions.Options;
 using Volo.Abp.AspNetCore.Mvc.UI.RazorPages;
 using Volo.Blogging.Blogs;
 using Volo.Blogging.Blogs.Dtos;
+using Volo.Blogging.Pages.Blogs.Shared.Helpers;
 using Volo.Blogging.Posts;
 
 namespace Volo.Blogging.Pages.Blog.Posts
@@ -41,6 +42,10 @@ namespace Volo.Blogging.Pages.Blog.Posts
             {
                 return Redirect("/");
             }
+            if (BlogNameControlHelper.IsProhibitedFileFormatName(BlogShortName))
+            {
+                return NotFound();
+            }
 
             Blog = await _blogAppService.GetByShortNameAsync(BlogShortName);
             Post = new CreatePostViewModel

modules/blogging/src/Volo.Blogging.Web/Pages/Blogs/Shared/Helpers/BlogNameControlHelper.cs

@@ -0,0 +1,20 @@
+using System.IO;
+using System.Linq;
+
+namespace Volo.Blogging.Pages.Blogs.Shared.Helpers
+{
+    public static class BlogNameControlHelper
+    {
+        public static readonly string[] ProhibitedFileExtensions = new string[] {"ico", "txt", "php"};
+
+        public static bool IsProhibitedFileFormatName(string blogShortName)
+        {
+            if (string.IsNullOrWhiteSpace(blogShortName))
+            {
+                return false;
+            }
+
+            return ProhibitedFileExtensions.Any(x => blogShortName.ToLowerInvariant().EndsWith(x));
+        }
+    }
+}

modules/blogging/test/Volo.Blogging.Application.Tests/Volo.Blogging.Application.Tests.csproj

@@ -11,6 +11,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\..\src\Volo.Blogging.Application\Volo.Blogging.Application.csproj" />
+    <ProjectReference Include="..\..\src\Volo.Blogging.Web\Volo.Blogging.Web.csproj" />
     <ProjectReference Include="..\Volo.Blogging.Domain.Tests\Volo.Blogging.Domain.Tests.csproj" />
   </ItemGroup>
 

modules/blogging/test/Volo.Blogging.Application.Tests/Volo/Blogging/BlogAppService_Tests.cs

@@ -6,6 +6,7 @@ using Volo.Blogging.Blogs;
 using Volo.Blogging.Blogs.Dtos;
 using Volo.Blogging.Comments;
 using Volo.Blogging.Comments.Dtos;
+using Volo.Blogging.Pages.Blogs.Shared.Helpers;
 using Volo.Blogging.Posts;
 using Xunit;
 
@@ -41,6 +42,25 @@ namespace Volo.Blogging
             blog.Name.ShouldBe(targetBlog.Name);
         }
 
+        [Theory]
+        [InlineData("favicon.ICO")]
+        [InlineData("favicon.ico")]
+        [InlineData("wp-login.php")]
+        [InlineData("wp-login.PHP")]
+        [InlineData("robots.txt")]
+        public void Should_Return_True_For_FileExtension_Shortname(string blogShortName)
+        {
+            BlogNameControlHelper.IsProhibitedFileFormatName(blogShortName).ShouldBe(true);
+        }
+
+        [Theory]
+        [InlineData("test-post")]
+        [InlineData("Test.Module")]
+        public void Should_Return_False_For_Normal_Shortname(string blogShortName)
+        {
+            BlogNameControlHelper.IsProhibitedFileFormatName(blogShortName).ShouldBe(false);
+        }
+
         [Fact]
         public async Task Should_Create_A_Blog()
         {