Sitefinity Dev Blogs

Now Available in the Sitefinity Marketplace

Gabe Sumner — Mon, 08 Mar 2010 21:44:55 GMT

I’m happy to announce that the Sitefinity community has been very active lately creating new items for Sitefinity’s Marketplace.

Several new items have recently been posted to Sitefinity’s Marketplace.

Events Map Plugin

Events Map is a plug-in that displays events on a global map via Google Maps. It produces the map with pins of all the events you have available on your website. A click of the pin will open a billboard-type section on the map with the event details with a link to the event page.

Created by Basem Emara.

Events Rotator Plugin

Events Rotator is a plug-in that displays events in a rotator fashion anywhere on your site. It slides through all the events you have available on your website and displays a nicely formatted thumbnail, title, and time of the event. A click of the slideshow will take you to the full event page

Created by Basem Emara.

Falafel Newsletter Group Importer

With the Falafel Newsletter Group Importer you'll be ready to click the send button in a matter of seconds! Easily load all of your customer names and email addresses from a simple comma separated file (csv) directly into Sitefinity with this bulletproof wizard.

Created by Falafel Software Inc.

FormBuilder Module

The FormBuilder is a module-based plug-in that allows non-technical administrators to create unlimited forms from their control panel

Created by Basem Emara.

Google Static Map Control

The Google Static Map control generates a map image using the latest Google Static Maps API. The map is centered on the address of your choice, with or without a marker. A "click map for directions" link can be enabled.

Created by Data Universal Inc.

News Rotator Plugin

News Rotator is a plug-in that displays news in a rotator fashion anywhere on your site. It slides through all the news you have available on your website and displays a nicely formatted thumbnail, title, and time of the it was published. A click of the slideshow will take you to the full news page.

Created by Basem Emara.

------------

If you’re interested, you’re invited to post your own Sitefinity add-on or template. To create a new listing, please visit our “Make a Submission” page.

How to secure Sitefinity’s Administrative UI

Gabe Sumner — Thu, 04 Mar 2010 17:34:45 GMT

Sitefinity’s Administrative Web Interface is accessed by adding /Sitefinity to the web site’s URL. Users are then required to provide a valid username & password to gain entry to Sitefinity. By default, Sitefinity’s administrative username is set to admin.

A few customers have expressed concern that this does not offer enough protection from malicious users or bots. If an attacker knows a web site is using Sitefinity then they also know the login URL and the admin username. The only thing that remains is the admin password.

This article explains how Sitefinity (and ASP.NET) help protect your web site. This article also suggests a few techniques for adding additional layers of protection to Sitefinity’s Administrative UI.

Too Many Invalid Password Attempts

There are plenty of password cracking tools that will bombard a web login form with password variations. These login attempts can stream as fast as the web server can accept them. After several hours (or days) these automated tools eventually stumble onto a valid password.

The first line of defense to these brute force password attacks is to pick a reasonable password. Dictionary attacks assume the password is a valid word or a common password. Consequently, passwords containing common words are much easier to guess.

Here are some very general password guidelines:

Passwords should be at least 8 characters longer. The longer the better…
Passwords should be mixed-case
Passwords should contain a mixture of numbers & letters
Passwords should not use common words

A good password makes it difficult to randomly stumble into the right combination of numbers & letters. To further discourage these brute force attacks, Sitefinity’s Membership Provider will (by default!) temporarily lock out accounts that have too many failed password attempts.

Sitefinity’s Membership provider is configured in the ~/web.config file:

<membership defaultProvider="Sitefinity" userIsOnlineTimeWindow="15" hashAlgorithmType="">
  <providers>
    <clear/>
    <add name="Sitefinity" 
      connectionStringName="DefaultConnection" 
      type="Telerik.DataAccess.AspnetProviders.TelerikMembershipProvider, Telerik.DataAccess" 
      enablePasswordRetrieval="false" 
      enablePasswordReset="true" 
      requiresQuestionAndAnswer="false" 
      applicationName="/" 
      requiresUniqueEmail="false" 
      passwordFormat="Hashed" 
      maxInvalidPasswordAttempts="5" 
      passwordAttemptWindow="10" 
      passwordStrengthRegularExpression="" 
      minRequiredPasswordLength="1" 
      minRequiredNonalphanumericCharacters="0"/>
  </providers>
</membership>

By default, Sitefinity is configured to limit password attempts (maxInvalidPasswordAttempts) to 5. The lock out time (passwordAttemptWindow) for the account is set to 10 minutes. Membership properties can be edited to provide different security settings. This limits an attacker’s ability to bombard a login form with tons of password variations.

Discourage Brute Force Password Attacks with Captcha

Sitefinity comes included with RadControls for ASP.NET AJAX. Included in this suite of controls is a Captcha control. This control can be added to Sitefinity’s login to prevent bots from auto-submitting the login form. Captcha discourages attackers from using automated brute force or dictionary attacks to discover the admin password. Bypassing Captcha requires human intervention or a more sophisticated automated tool.

To enable RadCaptcha, insert the following code near the top of the ~/Sitefinity/Login.aspx page:

<%@ Register Assembly="Telerik.Web.UI" Namespace="Telerik.Web.UI"  TagPrefix="telerik" %>

Then add the RadCaptcha control to the Login control’s LayoutTemplate (just after the RememberMe checkbox):

<li>
    <telerik:RadCaptcha 
        ID="RadCaptcha1" 
        ErrorMessage="Invalid Captcha" 
        ValidationGroup="LoginBox" 
        CaptchaImage-BackgroundNoise="Low"
        CaptchaImage-FontWarp="Low"
        CaptchaImage-LineNoise="Low"
        CaptchaImage-TextLength="5"
        runat="server" />
</li>

Each login to Sitefinity will now also require Captcha.

If needed, the Background Noise, Text Warp and Line Noise levels can be set to High. These settings will make it even harder for computers to read this text. However, it will also make it harder for your users to read this text. RadCaptcha has a lot of interesting properties; feel free to experiment.

This tip is courtesy of our friends at Mallsoft.

Disable the Admin User

By default Sitefinity’s administrative user is named admin. Using Sitefinity’s Administrative UI a new administrative user can be created and the old admin user deleted. This makes it harder to guess the administrative user login.

1. Create a new administrative user and make this user a member of the administrators role.

2. Log out and then login using this new administrative user.

3. Test thoroughly before removing the original admin user!

4. Before the the old admin user can be deleted this account must be removed from the administrators role.

5. After this role has been removed the original admin user can be deleted.

Limit access to Sitefinity’s Administrative UI

Access to Sitefinity’s Administrative UI can also be limited using a custom HttpModule (as detailed here). HttpModules can filter incoming HTTP requests before content is served. Incoming content requests can be rejected or redirected based on custom parameters (for example, the user’s IP address).

The following example limits access to Sitefinity’s Administrative UI to a specific block of IP addresses.

~/App_Code/AdminIpFilter.cs

using System;
using System.Web;

public class AdminIpFilter : IHttpModule
{
    public void Dispose()
    {
    }

    public void Init(HttpApplication context)
    {
        context.BeginRequest += new EventHandler(context_BeginRequest);
    }

    void context_BeginRequest(object sender, EventArgs e)
    {
        HttpContext current = HttpContext.Current;

        string filePath = current.Request.AppRelativeCurrentExecutionFilePath.ToLower();

        if (filePath.StartsWith("~/sitefinity"))
        {
            string userIp = current.Request.ServerVariables["REMOTE_ADDR"];

            if (userIp.StartsWith("127.0.0") == false)
            {
                current.Response.Redirect("http://www.sitefinity.com");
            }
        }
    }
}

This custom HttpModule can be installed in the ~/web.config file:

<httpModules>
  <add name="AdminIpFilter" type="AdminIpFilter, App_Code"/>
</httpModules>

Track Administrative Accesses Using Google Analytics

There is a Sitefinity KB article that describes how to add Google Analytics to a Sitefinity web site. This article describes how to add Google Analytics to public Sitefinity pages (not Admin pages). Thankfully, the same technique works for Backend Admin pages.

To add tracking to Sitefinity’s Administrative UI, the Google Analytics tracking code needs added to the Master Page Template used by Sitefinity’s Admin Pages:

~/Sitefinity/Admin/Admin.master

In addition, the Google Analytics tracking code also needs added to the Login Page:

~/Sitefinity/Login.aspx

Below is a sample Google Analytics tracking code. Each web site will have its own unique tracking code.

<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("UA-99992654-1");
pageTracker._trackPageview();
} catch(err) {}</script>

Change Sitefinity’s Administrative Login URL

Sitefinity’s administrative login can be guessed because all Sitefinity web sites use the very same login URL. The login URL can be changed by renaming Sitefinity’s Login page:

Rename ~/Sitefinity/Login.aspx to ~/Sitefinity/ObscureLogin.aspx
Rename ~/Sitefinity/Login.aspx.cs to ~/Sitefinity/ObscureLogin.aspx.cs
Rename ~/Sitefinity/App_LocalResources/Login.aspx.resx to ~/Sitefinity/App_LocalResources/ObscureLogin.aspx.resx

Sitefinity’s Administrative UI can now only be accessed using a special login URL:

http://yourwebsite.com/Sitefinity/ObscureLogin.aspx

Any other URL will attempt to redirect to ~/Login.aspx (which no longer exists) and will throw a 404 error. The user will need to know the login URL before they gain access to Sitefinity’s Admin. UI.

This technique is known as security through obscurity; it certainly isn’t bullet-proof but might serve as a first line of defense.

Conclusion

In most cases Sitefinity’s default settings coupled with a good password will be enough to discourage most attackers. However, if this does not provide sufficient protection the techniques described above will install several additional hurdles:

The admin URL is not easily guessable
The admin username is not easily guessable
The admin password is not easily guessable
Accounts with too many failed password attempts are temporarily locked out
Captcha discourages automated scripts from submitting the login form
Only specific IP addresses can access the admin pages
Admin access can be monitored with Google Analytics

If you’ve discovered additional tips or tricks please post a comment below.

Send items from Images and Documents module as e-mail attachments

Radoslav Georgiev — Wed, 03 Mar 2010 12:35:00 GMT

In this blog post we will sample a custom control which allows users to select files uploaded to images and documents module and send them as e-mail attachments. We will create a custom control and make it look similar to the built in Download List control. However this control will allow users to select content items and send them to provided e-mail. Bellow is a sample of how our control will look like.

Let us first start by creating the control template for our custom control. We will populate the items in a RadGrid for ASP.NET AJAX as this control allows us to handle multiple selected items out of the box. We will make the control display items in a fashion similar to the built in Download List control. We will also need to add a text box for inputting user e-mail, a couple of validators for validating correct e-mails and a button, which when clicked will send items to specified e-mail address. The sample control template can be found bellow:

<%@ Control Language="C#" %>

<%@ Register Assembly="Telerik.Web.UI" Namespace="Telerik.Web.UI" TagPrefix="telerik" %>

<telerik:RadGrid ID="ItemsGrid" runat="server" AllowAutomaticInserts="False" AllowAutomaticUpdates="False" AllowAutomaticDeletes="False" ShowStatusBar="True"

AllowPaging="True" PageSize="50" EnableViewState="True" Skin="Sitefinity"

AllowMultiRowSelection="True" GridLines="None" AutoGenerateColumns="False">

<MasterTableView AllowMultiColumnSorting="false" CommandItemDisplay="None" CssClass="listItems listItemsBindOnClient" Width="98%">

<Columns>

<telerik:GridClientSelectColumn UniqueName="CheckboxSelectColumn" Text="Select"></telerik:GridClientSelectColumn>

<telerik:GridBoundColumn UniqueName="ID" DataField="ID" Visible="false"></telerik:GridBoundColumn>

<telerik:GridTemplateColumn UniqueName="Name" HeaderText="Name">

<ItemTemplate>

<asp:HyperLink ID="DownloadLink" runat="server">

<asp:Literal ID="Name" runat="server"></asp:Literal>

</asp:HyperLink>

</ItemTemplate>