Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

Note: The downloadable file was updated 2009-11-05. If you downloaded the file available prior to that date please download the new revision.

Release Date: 2009-10-29

Installation Instructions:

This hotfix requires EPiServer Community version 3.2.517.24 and Hoftix 1 to be in place before installing, please verify that before proceeding.

  1. Run the SQL script "update.sql" in the database used by the site that is being updated.
  2. Copy the updated assemblies (*.dll) into the "bin" folder of the web site:
  3. Copy the updated controls (*.ascx):
  4. Adding a MissingImage delegate (optional)
    A new delegate has been provided that is called when an image could not be
    located to create its thumbnail. Previously, this error unconditionally threw
    an exception, but now it's possible to hook into and customize the behaviour.

    Below is an example of how to customize the behaviour so that a thumbnail
    of the default image is returned if the requested image could not be located,
    and a BrokenThumbnail-instance is returned if neither the requested nor default
    image could be located.

    public class BrokenThumbnail : Thumbnail
        protected internal BrokenThumbnail(int id, int width, int height, int parentId, ThumbnailFormat tf)
            : base(id, width, height, parentId, tf)

    During initialization run code similar to this to set up an appropriate delegate instance for GetThumbnailForMissingImageCallback.
    Image _defaultImage;

    // Call this method in an appropriate location of your initialization code.
    public void InitializeMissingImage()
        _defaultImage = ImageGalleryHandler.GetImage(113);
        ImageGalleryHandler.GetThumbnailForMissingImageCallback = (image, width, height, thumbnailFormat) =>
            // This if-statement makes sure that we don't enter
            // a nonending loop should we fail to create a
            // thumbnail for _defaultImage.
            if (_defaultImage == image)
                return new BrokenThumbnail(-1, width, height, _defaultImage.ID, thumbnailFormat);

            return defaultImage.GetThumbnail(width, height, thumbnailFormat);

This hotfix addesses the following problems and bugs:

Improved performance in ForumHandler.GetTopics
Improved performance in clubHandler.GetClubs
Improved performance in ImageGalleryHandler.GetImages

#29974: DocumentArchive would delete a document if UpdateDocument was called unless the document was moved to another DocumentArchive
#30042: Some ForumHandler.GetQueryResult implementations for RoomQuery passes Room instead of RoomBase to QueryHandler, causing it to erroneously return Room-instances when ChildRooms were expected.