Products

Evoq Content Overview Content Creation Workflow Asset Management Mobile Responsive Personalization Content Analytics SEO Integrations Security Website PerformanceEvoq Engage Overview Community Management  Dashboard  Analytics  Member Profile Gamification Advocate Marketing Community Engagement  Ideas  Answers  Discussions  Groups  Wikis  Events Mobile ReadyDNN Support PackagesEvoq: CMS FeaturesEvoq OnDemandCompare DNN's CMS Products

Solutions

Content Management SystemMulti-Channel PublishingDigital MarketingOnline Community ManagementIntranet Software SolutionOur CustomersPrime

Resources

Test DrivesSchedule A DemoDocumentation CenterWebinarsWhite PapersProduct ManualsRequest PricingData SheetsCase StudiesEvoq Preferred Products Content Management Ecommerce Forms Identity Management and Authentication Site Management Social Themes

Partners

DNN Partners Partner Directory Become a DNN Partner Partner Program Overview  Hosting  Implementation  ISV  Training  Competencies

Community

Participate Ask a Question Forums Community Showcase DNN MVP  Program Overview  Lifetime MVPs  Honorary MVPs Subscribe to DNN Digest Advisory Groups  Awareness Advisory Group  Developer Advisory Group  Partner Advisory Group  Technology Advisory GroupLearn Documentation Wiki Community Blog Video Library Project History Development RoadmapDownload DNN Store Language Packs Manuals Nightly BuildsSecurity Policies Security Center

Blog

About

News Press Releases News Coverage Press KitCareersContact DNN

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen
HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Twilight Zone...Twilight Zone...
Previous
 
Next
New Post
5/14/2013 11:10 PM
 
Robert Hanson


Joined: 9/2/2008
Posts: 207

Today, on the same servers, two separate DNN 6.x instances were interrupted by the Default.aspx file being renamed and overwritten by the script below, which caused redirect loops and DOS shutdowns.  All it took to fix it was looking at the first step into the DNN instance...  My hoster spotted it while trying a trace and suggested I recopy that file from another working instance or my backups.

Bob H.

BAD default.aspx

<%@ Page Language="C#" %>

<script runat="server">
    
    protected override void OnInit(EventArgs e)
    {
        base.OnInit(e);

        PortalSettings settings = PortalController.GetCurrentPortalSettings();
        CultureInfo pageLocale = Localization.GetPageLocale(settings);
        if ((settings != null) && (pageLocale != null))
        {
            Localization.SetThreadCultures(pageLocale, settings);
        }
    }    
    
protected override void OnLoad(EventArgs e)
{
base.OnLoad(e);

   var domainName = "";
   int urlIndex;

// parse the Request URL into a Domain Name token 
string[] url = Request.Url.ToString().Split('/');
for (urlIndex = 2; urlIndex <= url.GetUpperBound(0); urlIndex++)
{
bool willExit = false;
switch (url[urlIndex].ToLower())
{
case "admin":
case "desktopmodules":
case "mobilemodules":
case "premiummodules":
willExit = true;
break;
default:
// check if filename
if (url[urlIndex].IndexOf(".aspx", StringComparison.Ordinal) == -1)
{
domainName = domainName + (!string.IsNullOrEmpty(domainName) ? "/" : "") + url[urlIndex];
}
else
{
willExit = true;
}

break;
}
if (willExit)
break;
}

// format the Request.ApplicationPath
string serverPath = Request.ApplicationPath;
if (serverPath != null && serverPath.Substring(serverPath.Length - 1, 1) != "/")
{
serverPath = serverPath + "/";
}

        PortalSettings portal = PortalController.GetCurrentPortalSettings();

var queryString = Request.Url.Query.TrimStart('?');

        if (Request.Url.Query.Length == 0 && portal.HomeTabId > Null.NullInteger)
        {
Response.Redirect(DotNetNuke.Common.Globals.NavigateURL(portal.HomeTabId, portal, string.Empty, queryString), true);
        }
        else
        {
domainName = string.Format("{0}Default.aspx?alias={1}&{2}", serverPath, domainName, queryString);

            Response.Redirect(domainName, true);
        }

}

</script>

 

GOOD default.aspx

<%@ Page Language="C#" AutoEventWireup="false" Inherits="DotNetNuke.Framework.DefaultPage"
    CodeFile="Default.aspx.cs" %>

<%@ Register TagPrefix="dnnui" Namespace="DotNetNuke.Web.UI.WebControls" Assembly="DotNetNuke.Web" %>
<%@ Register TagPrefix="dnn" Namespace="DotNetNuke.Common.Controls" Assembly="DotNetNuke" %>
<%@ Register TagPrefix="telerik" Namespace="Telerik.Web.UI" Assembly="Telerik.Web.UI" %>
<asp:literal id="skinDocType" runat="server"></asp:literal>
<html <%= HtmlAttributeList %>>
<head id="Head" runat="server">
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
    <meta content="text/javascript" http-equiv="Content-Script-Type" />
    <meta content="text/css" http-equiv="Content-Style-Type" />
    <meta id="MetaRefresh" runat="Server" http-equiv="Refresh" name="Refresh" />
    <meta id="MetaDescription" runat="Server" name="DESCRIPTION" />
    <meta id="MetaKeywords" runat="Server" name="KEYWORDS" />
    <meta id="MetaCopyright" runat="Server" name="COPYRIGHT" />
    <meta id="MetaGenerator" runat="Server" name="GENERATOR" />
    <meta id="MetaAuthor" runat="Server" name="AUTHOR" />
    <meta name="RESOURCE-TYPE" content="DOCUMENT" />
    <meta name="DISTRIBUTION" content="GLOBAL" />
    <meta id="MetaRobots" runat="server" name="ROBOTS" />
    <meta name="REVISIT-AFTER" content="1 DAYS" />
    <meta name="RATING" content="GENERAL" />
    <meta http-equiv="PAGE-ENTER" content="RevealTrans(Duration=0,Transition=1)" />
    <style type="text/css" id="StylePlaceholder" runat="server"></style>
    <asp:placeholder id="CSS" runat="server" />
    <asp:placeholder id="SCRIPTS" runat="server" />
</head>
<body id="Body" runat="server">
    <asp:PlaceHolder ID="BodySCRIPTS" runat="server" />
    <dnn:Form ID="Form" runat="server" ENCTYPE="multipart/form-data">
        <asp:Label ID="SkinError" runat="server" CssClass="NormalRed" Visible="False"></asp:Label>
        <asp:PlaceHolder ID="SkinPlaceHolder" runat="server" />
        <input id="ScrollTop" runat="server" name="ScrollTop" type="hidden" />
        <input id="__dnnVariable" runat="server" name="__dnnVariable" type="hidden" />
    </dnn:Form>
    <script type="text/javascript">
        
        //This code is to force a refresh of browser cache
        //in case an old version of dnn.js is loaded
        //It should be removed as soon as .js versioning is added
        jQuery(document).ready(function () {
            if (navigator.userAgent.indexOf(" Chrome/") == -1) {
                if ((typeof dnnJscriptVersion === 'undefined' || dnnJscriptVersion !== "6.0.0") && typeof dnn !== 'undefined') {
                    window.location.reload(true);
                }
            }
        });
    </script>
</body>
</html>
 
New Post
5/15/2013 6:58 AM
 
Michael Tobisch


Michael Tobisch's Avatar

https://www.dnnwerk.at
Joined: 6/27/2005
Posts: 2083
Robert,

you should investigate if someone hacked your site. Most propably this is done with FTP access, so if you have one, check the FTP log files and find out if someone uploaded the default.aspx file.

Best wishes
Michael

Michael Tobisch
DNN★MVP

dnn-Connect.org - The most vibrant community around the DNN-platform
 
New Post
5/15/2013 8:25 AM
 
Robert Hanson


Joined: 9/2/2008
Posts: 207

This took some time to figure out.

I had 2 production instances, each with multiple portals.  One instance was in a folder called /ASP and one instance in a folder /SECURE. Both were 6.x versions of DNN.  The Primary Domain of the entire site is, hypothetically, domain.com.  Child portals of BOTH /SECURE and /ASP show up as sub-folders within them.  Their aliases include the child portal aliases domain.com/asp/childX and domain.com/secure/childY, for example.

Yesterday, as I mentioned in an unrelated post, I created two new test/dev instances of DNN 7.0.5, called TEST1 and TEST2.  These were created in the same domain.com as /test1 and /test2.

Once TEST1 and TEST2 were tested and functioning as new out-of-the-box 7.0.5 sites, with new databases, I restored a copy of the data from the db for /ASP to the new db for test 1.  .I (later) did the same thing, restoring the data for SECURE to test2.

During the install process the child portal default.aspx file from the new 7.0.5 instances [test1 and test2] crossed over and renamed/replaced the default.aspx files in ALL the domain.com/asp/childx and domain.com/secure/childy folders. [interestingly it still worked in a child folder].  Unfortunately it also renamed/replaced the default.aspx file for the main /ASP instance and the default.aspx file for the main /SECURE instance with this same "7.0.5 child portal file" [BAD in original post], which is a very different file... [GOOD in original post]

I found the cause and it was not a hack.  I did not change all the portal aliases before I set the new 7.0.5 loose on the restored db...  I was aided and abetted by the install scripts reaching out (crossing over) and mucking with my production instances...  This just sounds wrong...  I guess you can't cover for a bone-head admin...

Bob H.
 
 Page 1 of 1
Previous
 
Next
HomeHomeOur CommunityOur CommunityGeneral Discuss...General Discuss...Twilight Zone...Twilight Zone...


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out