Vulnerability in EPiServer.Forms
After updating to latest EPiServer version from nuget; project (multiple publish) stopped working correctly and all my blocks are ignored.
First I thought it was something wrong with my site, but then I tried starting a new project (Alloy) and got the same result.
Here is what I did:
- Created new Alloy "Project" in VS2015
- "Enabled projects" in CMS > Admin > Config > System settings > Editing
- Created new project (In CMS edit)
- Changed 1 page and 2 blocks and set them to "Ready to Publish" (Added to project)
- Chose "Publish 3 items"
- Worked fine, no problems
- Updated to latest nuget version of EPiServer (all packages)
- Built solution, updated database
- Changed 1 page and 2 blocks and set them to "Ready to Publish"
- Chose "Publish 3 items"
- Only the page was published, all blocks are ignored. No error in errorlog or feedback.
- Tried "Schedule Items for Publish"
- "Publish Delayed Content Versions" says : "2 content item(s) were published. 1 project(s) were published."
- But no blocks are published (Same as my original site)
Has anyone else had this problem?
Seems to be an issue in the latest core build. I have created a bug http://world.episerver.com/support/Bug-list/bug/CMS-4274 (might take a little while before it propagates to the website).
It looks like this issue appeared in version 9.11.0
Tried rolling back to:
- EpiServer.CMS > 9.11.0- EPiServer.Framework > 9.11.0- EPiServer.CMS.Core > 9.11.0
No change, still not working.
- EpiServer.CMS > 9.10.2- EPiServer.Framework > 9.10.2- EPiServer.CMS.Core > 9.10.2
Publishing blocks in "Projects" workes again.
Apparently the bug has already been reported: http://world.episerver.com/support/Bug-list/bug/CMS-4186
The reason why I started looking in to this is that my client said "Publish Delayed Content Versions" did not publish at the correct time set. When publishing multiple items they were published at different times. After trying it myself I found out that each time the job runs I get an error in "Event Viewer" that crashes the application on the server. Publishing the normal way gives no error.
I only get this error when "Projects" is activated in settings.
Is there a way to turn of notification on "Publish Delayed Content Versions" or is there another fix for this?
Since this is a built in function (job) in EPiServer I can’t see what is going on in this job.
I get the same error after starting a new EPiServer Alloy project and update all the “Nuget” packages.
Here is the error I get:
An unhandled exception occurred and the process was terminated.
Application ID: /LM/W3SVC/2/ROOT
Process ID: 7592
Message: Value cannot be null.Parameter name: UserName
StackTrace: at EPiServer.Notification.NotificationUser.set_UserName(String value) at EPiServer.Cms.Shell.UI.Notifications.ProjectMessageNotifier.<CreateNotificationMessage>d__17.MoveNext()--- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.AsyncMethodBuilderCore.<>c.<ThrowAsync>b__6_1(Object state) at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(Object state) at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx) at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx) at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem() at System.Threading.ThreadPoolWorkQueue.Dispatch() at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
After removing all projects, everything is working without error.
To reproduce this bug:
- Update all EPiServer nuget packages
- Create a project
- Add a page to the project
- Now all "Schedule for Publish" (blocks and pages in and outside the project) will give this error and the application will crash
- Remove the project and everything works without errors
This bug is now fixed:
http://world.episerver.com/support/Bug-list/bug/CMS-4444 (projects bug)
http://world.episerver.com/support/Bug-list/bug/CMS-4443 (blocks bug)