Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve SSL approach #4892

Merged
merged 7 commits into from
Jan 4, 2022
Merged

Conversation

donker
Copy link
Contributor

@donker donker commented Nov 2, 2021

This PR aims to do the following:

  1. Simplify the UI that manages the SSL settings for a site
  2. Introduce a simplified "make this site SSL" setting that doesn't require any other tweaks and ensures all content can only be accessed through https.

The overarching goal is to improve security. Users can get lost in the various settings and mistakes are easily made.

Implementation

The changes are as follows:

  1. Introduction of a new portal setting SSLSetup. This setting is an enum which (for now) consists of "Off", "On" and "Advanced". This setting replaces the old SSLEnabled setting.
  2. The SSL settings page in the Personabar now starts with a dropdown that sets the above setting. The other bits of the UI are shown dependent on the settings.
  3. Where necessary the code is adjusted to ensure that a site set to SSLSetup "On" always assumes URLs must be SSL.

Resolves #4942

@bdukes bdukes changed the base branch from develop to release/9.11.0 November 12, 2021 20:55
@bdukes
Copy link
Contributor

bdukes commented Nov 12, 2021

I've updated the base for this PR to the new release/9.11.0 branch, it is ready to merge once approved

Copy link
Contributor

@mitchelsellers mitchelsellers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, and great behavior changes I think this will help. I did make one suggestion for naming/consistency.

/// <summary>
/// Gets or sets the total nr of (non-deleted) tabs of the portal.
/// </summary>
public int NrTabs { get; set; }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that this field, and the following 2 should be either renamed to "NumberOfTabs" or "TabCount" to provide clear, non-shorted variable names.

Copy link
Contributor

@valadas valadas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than the mentioned suggestions and a double-check from @bdukes on potential breaking changes, this looks great to me. Nice one!

Copy link
Contributor

@valadas valadas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you sir.

@mitchelsellers mitchelsellers merged commit 43e4520 into dnnsoftware:release/9.11.0 Jan 4, 2022
@WillStrohl
Copy link
Contributor

WillStrohl commented Jan 4, 2022

I'm late to the party, but I have two questions...

  1. Shouldn't the primary underlying SSLEnabled property in the API be marked for deprecation and removed later?
  2. Shouldn't this setting UI and the web service be superuser-only? An administrator may not have the necessary knowledge/expertise to know what happens turning this feature on and off.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants