Vulnerability in EPiServer.Forms
I am trying to use newer configuration features of log4net in EPiServerLog.config to make environment specific configuration possible.
For example I want to use connectionStringName on the log4net.Appender.AdoNetAppender which is available from version 1.2.11.
However EPiServer Framework is using 1.2.10 and is preventing me from doing that. It targets the specific version of the assembly. However 1.2.11 should be backwards compatible.
Can this constraint be lifted in future versions of EPiServer?
have you read: http://world.episerver.com/documentation/items/developers-guide/episerver-cms/75/logging/logging-api/ ?
Since 7.17 (or something around that version), that restriction was basically lifted. The only assembly with the reference to log4net is now EPiServer.Logging.Log4Net (which is added for you by a dependency in EPiServer.CMS.Core.) EPiServer.Logging.Log4Net has a fixed log4net 1.2.10 dependency.
However, you should be able to replace EPiServer.Logging.Log4Net with your own logger. If you inspect the implementation of that assembly, you'll see that it is a very thin wrapper around log4net, and you can easily replace it with your own implementation that does not have the same strict dependency.
Thank you pointing this out! I will look at this further. In the meantime, I went for a different solution:
I have added code in Global.asax.cs to overwrite the database connection string with an application settting. This way I can define different connection strings for each environment.