Version 9.11.0 Upgrade/Install Changes

[mitchelsellers]

Description of problem

Current versions of the DNN Platform are distributed with Telerik installed and optional steps are necessary to disable Telerik after an installation or upgrade. The behavior of the DNN Platform should be changed in 9.11.0 to achieve the following goals.

• New Installations of DNN Platform should be Telerik-Free By Default
• Upgraded installations should be prompted with a suggestion of removal of Telerik, if they opt-in, Telerik should be removed
  • Best efforts should be made to try and validate that the Telerik removal can be done safely (Telerik Identifier source could be used for this)
• Auto-Upgraded installations (using /install/install.aspx?mode=upgrade) will retain Telerik

These changes will result in the DNN Platform being secure by default, and only allowing users to opt-out of security if needed

Description of solution

The following changes will be needed to complete the above-listed goals.

Install-Package Changes

• Existing Website Templates (Default & Blank) should be updated to remove Telerik, and the existing Digital Asset Manager, and replace those with Resource Manager #4895
• Existing Website Templates should be updated to make Activity Feed, My Profile, Friends, and Messages pages visible to Registered Users only by default #4894
• Existing Website Templates should be updated to set User Registration to None #4893
• Install Build Process needs to not longer include- DotNetNuke.Telerik.Web (DotNetNuke Telerik Web Components)- DigitalAssetsManagement (Digital Asset Management)- DotNetNuke.Web.Deprecated (DNN Deprecated Web Controls Library)- DotNetNuke.Website.Deprecated (DNN Deprecated Website Codebehind files) #4943
  - DotNetNuke.Telerik.Web (DotNetNuke Telerik Web Components)
  - DigitalAssetsManagement (Digital Asset Management)
  - DotNetNuke.Web.Deprecated (DNN Deprecated Web Controls Library)
  - DotNetNuke.Website.Deprecated (DNN Deprecated Website Codebehind files)
• The Resource Manger package needs to be converted from a .resources to a .zip #4944
• Updates to the InstallWizard.aspx file to prompt the user to set their desired SSL Configuration, IF they are accessing the site via SSL. If the user is NOT visiting the installer via SSL they will not see this option #4945
• Updates to the Pages module to set the default value for "Secure" to be true when the site is configured for SSL Enabled & Enforced #4942

Upgrade Experience Changes

• Update UpgradeWizard.aspx, require an superuser to choose whether to keep Telerik and remain insecure or to remove Telerik, IF, no dependencies are found. If the user selects to keep Telerik, the remainder of this process remains unchanged. #4946
• Update Upgrade Process to remove Telerik #4888

Security Analyzer Changes

• Update the existing check to report on the status of Telerik.- Fail if Telerik Installed & Used - Give warning about 10.x upgrade issue- Fail if Telerik Installed & Not-Used - Give message about the removal- Pass if Telerik Not Installed #4947
  - Fail if Telerik Installed & Used - Give warning about 10.x upgrade issue
  - Fail if Telerik Installed & Not-Used - Give message about the removal
  - Pass if Telerik Not Installed
• Add new Security Analyzer check for permissions on "Activity Feed" and "User Profile" pages #4948
  - If User Registration = None or Private and Either of these pages are visible to all users, warn that user profile information is displayed publicly
  - For all other user registration values, show an informational message if user profiles are public

[david-poindexter]

I have the template changes on my list of TODOs. Are you wanting separate tasks to be created for each?

[mitchelsellers]

@david-poindexter Most likely it woudl be easier, can convert one/all to individual tasks for tracking

[david-poindexter]

Thanks @mitchelsellers - I just converted those three items to issues and linked for tracking.

[daguiler]

Hi @mitchelsellers
I'm working on #4946 and I'm not clear about the difference with #4888.
Isn't #4888 actually included in #4946 ?

[bdukes]

Yes, they're connected. #4946 is primarily about adding the prompt. #4888 is about what happens when you make the choice via that prompt to remove Telerik.

[valadas]

I believe we have it all covered here 😄

[david-poindexter]