We Keep Coding

Web post with encoding issue

Everything was working fine – we get inbound text messages and this webpage accepts the call – parses out the data and then inserts into our database – a few days ago they started sending SOME of the url calls with a different encoding and now when it’s parsed there are odd characters in the string
Even the clickatell website when looking at the message on their reports - doesn't display properly - it inserts funky characters between each letter of the text. Assuming this is because end users are sending emoticons or something like that.
URL Call being sent to us –
http://website/clickatell.aspx?api_id=3360511&from=12173726674&timestamp=2018-01-24%2019%3A16%3A54&text=%00I%20%19%00m%00%20%00p%00e%00r%00m%00%20%00r%00i%00g%00h%00t%00%20%00n%00o%00w%00.%00%20%00B%00u%00t%00%20%00i%00f%00%20%00I%00%20%00s%00t%00a%00r%00t%00%20%00t%00r%00a%00v%00e%00l%00i%00n%00g%00%20%00a%00g%00a%00i%00n%00%2C%00%20%00I%20%19%00l%00l%00%20%00c%00o%00n%00t%00a%00c%00t%00%20%00y%00o&charset=UTF-16BE&udh=050003110201&moMsgId=a15c4039887a22425e9c42b86f6ddca4&to=17752374422
Normal URL call -
http://website/clickatell.aspx?api_id=3360511&from=15204455150&timestamp=2018-04-17%2019%3A17%3A05&text=Okay.%20I%27ll%20post%20it%20up%20in%20a%20bit.%20&charset=ISO-8859-1&udh=&moMsgId=f1690c98ff631db19ef26e619fd6f9e4&to=17752374422
ASPX Code (.Net 3.5) the If looks for the new encoding charset and executes the IF
if (Request.Url.ToString().IndexOf("UTF-16BE") > 0)
{
if (Request["api_id"] != null) sAPIId = Server.UrlDecode(Request["api_id"]);
if (Request["moMsgId"] != null) sMsgId = Server.UrlDecode(Request["moMsgId"]);
if (Request["from"] != null) sSource = Server.UrlDecode(Request["from"]);
if (Request["to"] != null) sTarget = Server.UrlDecode(Request["to"]);
if (Request["udh"] != null) sHeader = Server.UrlDecode(Request["udh"]);
if (Request["text"] != null) sText = Server.UrlDecode(Request["text"]);
}
else
{
if (Request["api_id"] != null) sAPIId = Request["api_id"];
if (Request["moMsgId"] != null) sMsgId = Request["moMsgId"];
if (Request["from"] != null) sSource = Request["from"];
if (Request["to"] != null) sTarget = Request["to"];
if (Request["udh"] != null) sHeader = Request["udh"];
if (Request["text"] != null) sText = Request["text"];
}
UrlDecode results in this – I’m sure there is an easy way to get from the hex encoding above to just a plain string – but I can’t seem to track it down.
"\0I _\0m\0 \0p\0e\0r\0m\0 \0r\0i\0g\0h\0t\0 \0n\0o\0w\0.\0 \0B\0u\0t\0 \0i\0f\0 \0I\0 \0s\0t\0a\0r\0t\0 \0t\0r\0a\0v\0e\0l\0i\0n\0g\0 \0a\0g\0a\0i\0n\0,\0 \0I _\0l\0l\0 \0c\0o\0n\0t\0a\0c\0t\0 \0y\0o"
Also tried Encoding.GetEncoding("ISO-8859-1").GetString(Encoding.Convert(Encoding.UTF8, Encoding.GetEncoding("ISO-8859-1"), Encoding.UTF8.GetBytes(Request.Url))) – but gave same result

Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

After running veracode scan, I got the CWE 113 error. I had found a solution to replace the cookie value, but still the issue is not fixed.
Fix for CWE-113: Improper Neutralization of CRLF Sequences in HTTP
Headers ('HTTP Response Splitting')
string ReplaceHTTPRequestValue(string Value)
{
string replacedValue = string.Empty;
if (!string.IsNullOrEmpty(Value))
{
replacedValue = Value.Replace("\r", string.Empty)
.Replace("%0d", string.Empty)
.Replace("%0D", string.Empty)
.Replace("\n", string.Empty)
.Replace("%0a", string.Empty)
.Replace("%0A", string.Empty);
}
return replacedValue;
}
void WebTrends_PreRender()
{
HttpCookie cookie = Request.Cookies["WT_CID"];
string campaignIdVal = string.Empty;
if (cookie != null)
{
campaignIdVal = ReplaceHTTPRequestValue(Request.Cookies["WT_CID"].Value);
}
else
{
campaignIdVal = string.Empty;
}
}
How can I solve this?

Please take a look at this link
https://community.veracode.com/s/question/0D53n00007YVaMrCAL/how-to-fix-flaws-for-cwe-id-113-http-response-splitting
It is likely the reason the flaw continues to be reported is because
the functions you are using are not in the list of Supported Cleansing
Functions, which you can find in the Help Center here:
https://help.veracode.com/go/review_cleansers. For example the
supported function org.owasp.encoder.Encode.forJava() would cleanse
for CWE-113, as well as CWE-117, CWE-80 and CWE-93. Please note that
it is important to select the appropriate cleansing function for the
context.

string ReplaceHTTPRequestValue(string Value)
{
string NonCRLF = string.Empty;
foreach (char item in Value)
{
NonCRLF += item.ToString().Replace("\n", "").Replace("\r","");
}
return NonCRLF;
}

Redirect in a Sitecore solution Noob

Here What I am trying to do, my employer want to be able to be able do 301 redirect with regex expression with the alias in Sitecore so the way I am trying to implement this is like this!
a singleline text field
with a checkbox to tell sitecore it will be a regex expression I am a noob in .NET and Sitecore how can I implement this ? here a exemple http://postimg.org/image/lwr524hkn/
I need help the exemple of redirect I want handle is like this, this is a exemple of the redirect I want to do it could be product at the place of solution.
exemple.com/en/solution/platform-features to
exemple.com/en/platform-features
I base the code from http://www.cmssource.co.uk/blog/2011/December/modifying-sitecore-alias-to-append-custom-query-strings-via-301-redirect this is for query string I want to use regex expression.
namespace helloworld.Website.SC.Common
{
public class AliasResolver : Sitecore.Pipelines.HttpRequest.AliasResolver
{
// Beginning of the Methods
public new void Process(HttpRequestArgs args)
{
Assert.ArgumentNotNull(args, "args");
if (!Settings.AliasesActive)
{
Tracer.Warning("Aliases in AliasResolver are not active.");
}
else
{
Sitecore.Data.Database database = Context.Database;
if (database == null)
{
Tracer.Warning("There is no context in the AliasResolver.");
}
else
{
{
Profiler.StartOperation("Resolve virgin alias pipeline.");
Item item = ItemManager.GetItem(FileUtil.MakePath("/sitecore/system/aliases", args.LocalPath, '/'), Language.Current, Sitecore.Data.Version.First, database, SecurityCheck.Disable);
if (item != null)
{
//Alias existis (now we have the alias item)
if (item.Fields["Regular Expressions"] != null)
{
if (!String.IsNullOrEmpty(item.Fields["Regular Expressions"].Value) && !args.Url.QueryString.Contains("aproc"))
{
var reg = new Regex(#"(?<Begin>([^/]*/){2})[^/]*/(?<End>.*)");
var match = reg.Match(#"exemple.com/en/solution/platform-features");
var result = match.Groups["Begin"].Value + match.Groups["End"].Value;
}
}
}
Profiler.EndOperation();
}
catch (Exception ex)
{
Log.Error("Had a problem in the VirginAliasResolver. Error: " + ex.Message, this);
}
}
}
}
///<summary>
/// Once a match is found and we have a Sitecore Item, we can send the 301 response.
///</summary>
private static void SendResponse(string redirectToUrl, HttpRequestArgs args)
{
args.Context.Response.Status = "301 Moved Permanently";
args.Context.Response.StatusCode = 301;
args.Context.Response.AddHeader("Location", redirectToUrl);
args.Context.Response.End();
}
}
}
PS: I know they have module for this but my employer want it done that way and I am reaching for help since it's been a week I'm trying to add this feature

So if I understand correctly, you do not want to select an Alias by path:
Item item = ItemManager.GetItem(FileUtil.MakePath("/sitecore/system/aliases", args.LocalPath, '/'), Language.Current, Sitecore.Data.Version.First, database, SecurityCheck.Disable);
But rather find an Alias comparing a Regex field to the Url. I have not tested this, but it could be someting like:
var originalUrl = HttpContext.Current.Request.Url;
var allAliases = Sitecore.Context.Database.SelectItems("/sitecore/system/aliases//*");
var foundAlias = allAliases.FirstOrDefault( alias =>
!string.IsNullOrEmpty(alias["Regular Expressions"]) &&
Regex.IsMatch(HttpContext.Current.Request.Url.ToString(), alias["Regular Expressions"]));
Then, if foundAlias != null, you can retrieve the url and redirect like you do in your private SendResponse function.
var linkField = (LinkField)foundAlias.Fields["linked item"];
var targetUrl = linkField.Url;
using (new SecurityDisabler())
{
if (string.IsNullOrEmpty(targetUrl) && linkField.TargetItem != null)
targetUrl = LinkManager.GetItemUrl(linkField.TargetItem);
}
SendResponse(targetUrl, args);
Again, I have not tested this so don't shoot me if it needs some corrections, but this should help you get on your way.

Updating ContentBlock pulled from pageManager.LoadControl(). Sitefinity 5

Asked this on the forums as well, but no luck as of yet. What I need to do is set the HTML content of each content block on a given page. It seems that I can set the html value okay, but saving it does not update the actual page.
I'm wondering if it's because there needs to be some sort of save call on the control. There doesn't seem to be any methods available for such an action.
foreach (var c in duplicated.Page.Controls)
{
// go through the properties, se the ID to grab the right text
foreach (var p in c.Properties)
{
if (p.Name == "ID")
{
var content = pageContent.Where(content_pair => content_pair.Key == p.Value).SingleOrDefault();
var control = pageManager.LoadControl(c);
if (control is ContentBlock)
{
var contentBlock = pageManager.LoadControl(c) as ContentBlock;
contentBlock.Html = content.Value;
}
}
}
}
pageManager.SaveChanges(); */
WorkflowManager.MessageWorkflow(duplicated.Id, typeof(PageNode), null, "Publish", false, bag);

The following code may help you achieve what you need.
It will first get the page by its title (I am looking for a page by the title "duplicated" as it's implied by your code).
It generates a new draft of the current page, then go over its controls.
Controls which are detected as content blocks are then iterated in a foreach loop.
As written in the comment inside the foreach loop, you may detect controls by their explicit ID (by the property named "ID") or by their related shared content block (by the property named "SharedContentID") or any other condition (or ignore this condition altogether, which would result in updating all the controls n the page.
Once we have a control to update at hand, you can set its new value depending on the localization settings of your project.
After that the draft is saved and published and optionally a new version is created for it.
PageManager pageManager = PageManager.GetManager();
VersionManager vmanager = VersionManager.GetManager();
PageNode duplicated = pageManager.GetPageNodes().FirstOrDefault(p => p.Title == "duplicate");
if (duplicated != null)
{
var draft = pageManager.EditPage(duplicated.Page.Id, true);
string contentBlockTypeName = typeof(ContentBlock).FullName;
PageDraftControl[] contentBlocks = draft.Controls.Where(contentBlock => contentBlock.ObjectType == contentBlockTypeName).ToArray();
foreach (PageDraftControl contentBlock in contentBlocks)
{
Guid contentBlockId = contentBlock.Id;
//User "SharedContentID" if you are looking up controls which are linked to a shared content block of a specific ID.
//If you you are trying to locate a specific control by its own ID, use the explicit "ID" property instead of "SharedCotentID"
if (contentBlock.Properties.Where(prop => prop.Name == "SharedContentID" && prop.Value.ToString() == contentItemIdstr).FirstOrDefault() != null)
{
ControlProperty htmlProperty = contentBlock.Properties.Where(prop => prop.Control.Id == contentBlockId && prop.Name == "Html").FirstOrDefault();
if (htmlProperty != null)
{
if (AppSettings.CurrentSettings.Multilingual)
{
htmlProperty.GetString("MultilingualValue").SetString(CultureInfo.CurrentUICulture, "New Value");
}
else
{
htmlProperty.Value = "New Value";
}
}
}
}
draft = pageManager.SavePageDraft(draft);
draft.ParentPage.LockedBy = Guid.Empty;
pageManager.PublishPageDraft(draft);
pageManager.DeletePageTempDrafts(draft.ParentPage);
//Use the 2 next lines to create a new version of your page, if you wish.
//Otherwise the content will be updated on the current page version.
vmanager.CreateVersion(draft, draft.ParentPage.Id, true);
vmanager.SaveChanges();
pageManager.SaveChanges();
}
I hope this code helps.
Alon.

Determine display mode of sharepoint page

I have this question many times and bored while trying to find good solution.
Dont understand why microsoft not include method which can easy determine mode of display page: "normal display" or in "design mode".
It have many advices of check different variables, but it cant uniquely say that page in design on different type of page(webpart page and wiki page) and on postback or not.
Is finally tired me and i write this:
public static bool IsDesignTime()
{
if (SPContext.Current.IsDesignTime) return true;
if (HttpContext.Current.Request.QueryString["DisplayMode"] != null)
return true;
var page = HttpContext.Current.Handler as Page;
if(page == null) return false;
var inDesign = page.Request.Form["MSOLayout_InDesignMode"];
var dispMode = page.Request.Form["MSOSPWebPartManager_DisplayModeName"];
var wikiMode = page.Request.Form["_wikiPageMode"];
var we = page.Request.Form["ctl00$PlaceHolderMain$btnWikiEdit"];
if (inDesign == null & dispMode == null) return false; //normal display
if (we == "edit") return true; //design on wiki pages
if (page is WikiEditPage & page.IsPostBack & inDesign == "" & dispMode == "Browse" & wikiMode == "") return false; //display wiki on postback
if (inDesign == "" & dispMode == "Browse" & (wikiMode == null | wikiMode == "")) return false; //postback in webpart pages in display mode
if (inDesign == "0" & dispMode == "Browse") return false; //exiting design on webpart pages
return true;
}
Does anybody have better solution?

you have 2 case to detect the page mode:
In case you are using a team site :
if (Microsoft.SharePoint.SPContext.Current.FormContext.FormMode == SPControlMode.Edit)
{
ltr.Text = "EditMode2";
}
else
{
ltr.Text = "ViewMode";
}
in case you are using a publishing site:
if (Microsoft.SharePoint.SPContext.Current.FormContext.FormMode == SPControlMode.Display)
{
// your code to support display mode
}
else // Microsoft.SharePoint.SPContext.Current.FormContext.FormMode = SPControlMode.Edit
{
// your code to support edit mode
}

if your work in WebpartPage than below code work for me
WebPartManager mgr = this.WebPartManager;
if (mgr.DisplayMode == WebPartManager.EditDisplayMode)
{
// logic when in Edit Mode
}
else
{
}

I had a hard time getting any of these answers to work in Sharepoint 2013 given all the scenarios. I also couldn't get EditModePanel to work consistently. I found a snippet in this article that seems to work in every scenario I've tried so far.
Note: This does not work in Page_Init but will work in Page_Load
var isPublishing = SPContext.Current.FormContext.FormMode != SPControlMode.Invalid;
var wpDMode = WebPartManager.GetCurrentWebPartManager(Page).DisplayMode.Name;
var isEditing = isPublishing
? SPContext.Current.FormContext.FormMode != SPControlMode.Display
: (wpDMode.Equals("Edit") || wpDMode.Equals("Design"));
Then you can simply check isEditing for your conditions.

please try this code ..
if (Microsoft.SharePoint.SPContext.Current.FormContext.FormMode == SPControlMode.Display)
{
// your code to support display mode
}
else // Microsoft.SharePoint.SPContext.Current.FormContext.FormMode = SPControlMode.Edit
{
// your code to support edit mode
}

Handling SharePoint Page Modes.
This works for me , I resolved my critical issue by using below lines.
if (Microsoft.SharePoint.SPContext.Current.FormContext.FormMode == SPControlMode.Edit)
{
alert.Text = "EditMode2";
}
else
{
alert.Text = "ViewMode";
}