After upgrade to 9.10.1 Error SecurityController.UpdateOtherSettings

[sboshuis]

Description of bug

After upgrade to 9.10.1 Error SecurityController.UpdateOtherSettings

ExceptionType:System.NullReferenceException,StackTrace: bij DotNetNuke.Common.Utilities.Config.SetMaxUploadSize(Int64 newSize)

Steps to reproduce

List the precise steps to reproduce the bug:

1. Go to Security settings more settings where e.g. max file upload size is
2. Open Console in F12
3. Change something and Save
4. Error 500 in network tab on UpdateOtherSettings

Expected behavior

No Error 500

Error information

I would propose to add some checking in the code so if the attribute is missing then add it to the node in the public static void SetMaxUploadSize(long newSize)

Basically in the web config it looks like

(please note that often the attribute maxAllowedContentLength is not there and just falls back to its default) So the code wants to set an attribute that is not there and should be added in this case.

Affected version

• [ ] 10.00.00 alpha build
• [X] 09.10.01 latest supported release

[sboshuis]

work around for anyone facing this issue like me is manually adding maxAllowedContentLength with a value to requestLimits node in security/requestfiltering than go back to dnn and press save again. Now it will save without error

[david-poindexter]

Thanks for logging this issue @sboshuis - what version of DNN were you upgrading from? I am mot sure if this is related to the issue or not, but just in case, it may be helpful to know.

[sboshuis]

in this case 9.8.1 but I have many more web configs where this tag is not there

[WillStrohl]

I don't see this in the web.config in any of the sites I've checked so far.

[david-poindexter]

Thanks for confirming @hismightiness 🎉

[valadas]

I cannot make this happen in 9.10.1 and also don't have that node in any of the web.config files I can see on many past versions. I am closing this issue but if you can come up with accurate steps for a developer to make this happen, please comment and I'll be happy to reopen.

[sboshuis]

Will give you extra info how to replicate I can do this in any of my installs and retested just now and made print screens for you. will contact you on slack

[valadas]

In my case, that value changes the maxRequestLenght on the configuration->httpRuntime value and I have no security node in the web.config

[WillStrohl]

@sboshuis Basically, we need to know how to duplicate something before anyone can realistically know what/how to fix the issue. In this case, everyone in this thread manages many DNN sites and none of us see this behavior yet. If you can provide the consistent steps to reproduce the issue, we'd be able to troubleshoot this further together.

[valadas]

Ok, after some chat with @sboshuis here are some straightforward steps to reproduce the issue. The user may have all those nodes but not that attribute and DNN just checks for the node existence and not the existence of the attribute.

1. Install a clean DNN instance and make sure the site loads
2. In the web.config, inside the system.webServer node, add the following

<security>
      <requestFiltering>
        <requestLimits maxQueryString="32768" />
      </requestFiltering>
    </security>

Note the absence of the maxRequestLenght attribute here 3. In the Persona Bar, go to Settings -> Security -> More security settings -> Change the Max Upload Size value 4. Open the browser console and try to save

Current behaviour: There Is a 500 Internal error and the setting is not saved.

Expected behaviour: The code should check for the attribute existence before trying to change the attribute values as it is possible to have all the proper nodes but not the attribute in place.

See: https://github.com/dnnsoftware/Dnn.Platform/blob/045097aee0797d5d38894e7fc7e4bc91732b4876/DNN%20Platform/Library/Common/Utilities/Config.cs#L332-L361

[WillStrohl]

Ah... These kinds of things are why our last step in the upgrade process is to perform a diff compare to a clean installed web.config of the same DNN version.