Vulnerability in EPiServer.Forms
When I have a page with "Name in URL" of "about" it causes child pages to not be found e.g. 404 and no controller is hit in Edit Mode.
This is fine on the front end e.g. non edit mode and also in viewing in EPiServer 6 interface e.g. EPiServer/CMS/edit/
Error example on a subpage e.g. lorem
Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly. Requested URL: /EPiServer/CMS/about/lorem,,47_2026/
To work around this the parent page is "Name in URL" is set to "about-example" this then resolves the subpages pages being shown in edit mode
The parent page can have the "Simple address" set to "about" so the front end URL has an easier to remember landing page e.g.
All child pages would then have the name in url with prefix "about-example" e.g.
If this is a bug that anyone else has?
That's a funny one!
I get too, after I tried creating the same pages you did.
I can see the pages in view mode, ie. localhost/About/lala/, but in Edit mode I also get 404 for:
"Requested URL: /EPiServer/CMS/About/lala,,634_2080/"
So I guess it's definitely a bug.
I think it might have something to do with the fact that EPi already has a page on the same location, when I click on the license in the top right menu in Edit mode, this is the URL:
This is a known issue and is caused by that the route collides with some EPiServer internal routes. This issue has been fixed and I think the fix will be available in next patch.