how to remove unnecessery handler mappings from Sharepoint 2010 web application for security purpose

This article explains how to restrict or remove unnecessary handler mappings for  Microsoft SharePoint Foundation web application in the Integrated Request Pipeline of Internet Information Services (IIS) .

As you know Sharepoint has modifed the pipeline for more information about Why Sharepoint modifing the request pipeline please read this topic :
http://msdn.microsoft.com/en-us/library/ee537834.aspx

For a general web application you can modify pipleline using:

  • Pipeline Changes at the ASP.NET Framework Level: Sharepoint  does not change any thing for this level that mean sharepoint makes no changes to the machine.config file or the global web.config file.
  • Pipeline Changes at the IIS Configuration Level : The modifications on applicationhost.config file.This file is located in the %WinDir%\System32\inetsrv\config\ directory and it contains registrations of the IIS Web sites and application pools on the server, as well as some settings that apply to all Web applications on the Web server. The settings in applicationhost.config are primarily oriented to the parts of the pipeline that are contributed by IIS, whereas the machine.config and the global web.config files contain settings that are primarily oriented to the parts of the integrated request pipeline that are contributed by ASP.NET.
  • Pipeline Changes at the SharePoint Web Application Level: The modifications on web.config files.
  • Pipeline Changes at the Directory Level : The modifications on directory levels still using web.config files.Particular physical or virtual directories in an IIS Web site can also have their own web.config file to add new settings or override inherited settings. The new settings and overrides, of course, apply only to HTTP requests for resources located within the directory and its subdirectories.

Important ! :In this article scope of “Pipeline Changes at the IIS Configuration Level” so get backup your applicationhost.config file before do anything in %WinDir%\System32\inetsrv\config\

Bellowed configuration is for standart sharepoint web application so if you have some custom codes that need extra handler please add needed handlers to list.

For removing handler mappings

1) open your IIS console.
2) select your Sharepoint Web Application
3) Click Handler Mappings.

And Remove unneceserry handler mappings by selecting and clicking remove button on iis console.

 The handlers in  picture below are the needed ones so don’t delete them.

So sharepoint is not use any .net framework 4.0 components and the other iis default isapi extentions.
Always make a test that your site is working correctly. For testing use these starting points:

  • Test Pages
  • Test System Pages
  • Test File Upload
  • Test Search
  • Test Sharepoint Designer Connection
  • Add your custom test items.

see you next articles.

Advertisement

WSS3.0 Service Pack 3 and MOSS2007 Service Pack 3 has been released.

For WSS 3.0 Service Pack 3:
http://support.microsoft.com/kb/2526305

For MOSS2007 Service Pack 3:
http://support.microsoft.com/kb/2526299

Installation Order:

Install WSS Service Pack 3
Install MOSS Service Pack 3

Install needed Language service packs:
Install Service Pack 3 for Windows SharePoint Services 3.0 Turkish
Install Service Pack 3 for Windows SharePoint Services 3.0 Arabic

After applying the preceding updates, run the SharePoint Products and Technologies Configuration Wizard or “psconfig –cmd upgrade –inplace b2b -wait” in command line. This needs to be done on every server in the farm with SharePoint installed.

Important! . As you know at same time october CU 2011 has already released. There is some problems upgrade both SP3 and October CU 2011. Microsoft has working on it. So your options now install sp3 or install october CU. Not upgrade together. I will inform you when it is fixed.

 

Attach custom master page to personal site using Stapling feature for Sharepoint 2010

Hi Everyone ,

In this article i am explaining how could we attach a custom master page to  Personal sites in MySite Host. I have created two Sharepoint Project named MyMasters and MyMastersStapling using Visual Studio 2010.

you can download the visual studio solution from CodePlex
http://mymasters.codeplex.com/

The solution is anwering fallowing questions  :

* How to deploy custom master page ?
* How to customize a masterpage ?
* How to attach custom master page to personal sites using staping feature ?
* How to set wellcome page programmatically ?
* How to add document library as a web part to a page ?


MyMasters  Project
: is a sharepoint project that deploy a custom master page to a sharepoint site.
MyMasterStapling  Project: is a sharepoint project that attach feature of MyMasters to personal site template and activates the publishing features

First i created a site scope feature named “MyMasters”  and and a feaurereciever .The important part is here the feature guid . You need this guid for feature stapling configuration. you can get the feature guid from Feature manifest file.

<Feature xmlns=”http://schemas.microsoft.com/sharepoint/” Title=”MyMasters” Description=”This feature enables defined master page for your site”
Id=”09c222f7-68ed-4278-a3ce-d64b8dbfb168” ReceiverAssembly=”MyMasters, Version=1.0.0.0, Culture=neutral, PublicKeyToken=2e49c3c1155d0e27″ ReceiverClass=”MyMasters.Features.MyMasters.MyMastersEventReceiver” Scope=”Site”>
… child nodes
</Feature>

And I have create two modules MasterPageModule and CustomAssests Module .

MasterPageModule : contains masterpage file and when the feature is activated it deploy master page the masterpage library under _catalogs folder.
CustomAssests : contains necessary css , js and image files. when the feature is activated it deploy assests to Style Library List of target site by creating specific folder for each asset type.

Here is the code of Feature Reciever.

public class MyMastersEventReceiver : SPFeatureReceiver
{
// Uncomment the method below to handle the event raised after a feature has been activated.
public override void FeatureActivated(SPFeatureReceiverProperties properties)
{
ApplyTheme(properties);
}
// Uncomment the method below to handle the event raised before a feature is deactivated.
public override void FeatureDeactivating(SPFeatureReceiverProperties properties)
{
RevertTheme(properties);
SPSite site = (SPSite)properties.Feature.Parent;
if (site != null)
{
//Remove custom master page
SPFile masterFile = site.RootWeb.GetFile(“_catalogs/masterpage/PersonalSite.master”);
masterFile.Delete();
//Remove assets folders.
site.RootWeb.Folders[“Style Library”].SubFolders.Delete(“CustomCssFiles”);
site.RootWeb.Folders[“Style Library”].SubFolders.Delete(“CustomJSFiles”);
site.RootWeb.Folders[“Style Library”].SubFolders.Delete(“CustomImages”);
}
}   private void ApplyTheme(SPFeatureReceiverProperties properties)
{
SPSite site = (SPSite)properties.Feature.Parent;
if (site != null)
{
// Set the System Master Page to orginal
Uri masterUri = new Uri(site.RootWeb.Url + “/_catalogs/masterpage/v4.master”);
site.RootWeb.MasterUrl = masterUri.AbsolutePath;
// Set the Publishing Master Page our custom PersonalSite.master page.
Uri customMasterUri = new Uri(site.RootWeb.Url + “/_catalogs/masterpage/PersonalSite.master”);
site.RootWeb.CustomMasterUrl = customMasterUri.AbsolutePath;
site.RootWeb.Update();
}
}
private void RevertTheme(SPFeatureReceiverProperties properties)
{
SPSite site = (SPSite)properties.Feature.Parent;
if (site != null)
{
// Set the System Master Page to orginal
Uri masterUri = new Uri(site.RootWeb.Url + “/_catalogs/masterpage/v4.master”);
site.RootWeb.MasterUrl = masterUri.AbsolutePath;
// Set the Publishing Master Page  to orginal
Uri customMasterUri = new Uri(site.RootWeb.Url + “/_catalogs/masterpage/v4.master”);
site.RootWeb.CustomMasterUrl = customMasterUri.AbsolutePath;
site.RootWeb.Update();
}
}
}

By default the following rule applies when you deploy a master page:

  • Site Master Pages: used by all publishing pages – and only by publishing pages
  • System Master Pages: used by everything else including forms and view pages

So in Feature reciever ->  ApplyTheme() function we set two master page first one is V4.master the orginal master for System masterpage and our custom master for Site Master page. As you know you have to enable Publishing Features for  the site if you want to this deplotment work correctly.
For deploying PersonalSite.master via module the element file :

<?xmlversion=1.0encoding=utf-8?>
<Elementsxmlns=http://schemas.microsoft.com/sharepoint/>
<ModuleName=MasterPageModuleList=116Url=_catalogs/masterpage>
   <FilePath=MasterPageModule\PersonalSite.master  Url=PersonalSite.masterType=GhostableInLibrary >
        <PropertyName=UIVersionValue=4 />
        <PropertyName=ContentTypeIdValue=0x010105 />
   </File>
</Module>
</Elements>

You can deploy this solution any site by using visual studio at the end you can able to see this view :

For MyMasterStapling Project . I have created a farm level feature named “MyMastersStapling” and an empty element named “StaplingElement”


Element.xml :

<?xmlversion=1.0encoding=utf-8?>
<Elementsxmlns=http://schemas.microsoft.com/sharepoint/>
<FeatureSiteTemplateAssociationId=f6924d36-2fa8-4f0b-b16d-06b7250180faTemplateName=SPSPERS#0 />
<FeatureSiteTemplateAssociationId=22a9ef51-737b-4ff2-9346-694633fe4416TemplateName=SPSPERS#0 />
<FeatureSiteTemplateAssociationId=09c222f7-68ed-4278-a3ce-d64b8dbfb168TemplateName=SPSPERS#0 />
</Elements>

The FeatureSiteTemplateAssociation element maps feature GUIDs to site defintions – note that the format of the TemplateName attribute value is <SiteDefName>#<ConfigurationID>. This obviously allows a degree of flexibility and allows you to do fairly complex things with different configurations of site definitions. As you now at the beginning of article we highlighted a GUID the feature of MyMasters.

The third item is using this guid 09c222f7-68ed-4278-a3ce-d64b8dbfb168 .What about first two ? these feature ids are blong to Publishing Features. First one is “Publishing Feature Site”  feature’s id at site level and the second one is Publishing feature’s id at web level.

These two ids are built in sharepoint 2010 and it is not change by installation .If you wonder how could i found this ids ,i used the powershell console for sharepoint :
get-spfeature | where-object { $_.DisplayName -like “*Publish*” }


For Template name  SPSPERS is the personal site template name.  for #Zero i am attaching the default configuration.

For More information about site templates.
http://office.microsoft.com/en-us/sharepoint-server-help/a-preview-of-the-sharepoint-server-2010-site-templates-HA101907564.aspx

So far so good. After you deploy our stapling project and activate the feature , the users can able to see our custom master page even if self site creation is enabled for personal sites .

See you next articles.

Sharepoint Deploying resource files to app_globalresources folder using Timer Job.

Hi Everyone ,
in this article i want to explain how to copy your resource files to web application’s app_globalresources folder using by a timer job.

As you know there is four place that the resource files has to be.

\14\Resources\
\14\Template\Features\<Feature Name>\Resources\
\14\Config\Resources\
[Virtual Directory] \App_GlobalResources\

I could not tell about which folder for what,  this is out of concept.But i will explain that

the files which in  \14\Config\Resources can copied to [Virtual Directory] \App_GlobalResources\ folder when a new web.application created. But what about the existing ones.
Friendly stsadm command give us some help.
STSADM -o CopyAppBinContent
But still you can run this command all your sharepoint servers.And this is not an aswer for if you aim to deploy some specific web applications.
You can use
SPWebApplication.ApplyApplicationContentToLocalServer()  fuction for do it with programmatically by creating and using a feature reciever class.

public override void FeatureDeactivating(SPFeatureReceiverProperties properties)
        {
            SPWebApplication webApp = properties.Feature.Parent as SPWebApplication;
            if (webApp != null)
            {
                 ...Somecodes.
                 webApp.Farm.Services.GetValue().ApplyApplicationContentToLocalServer();
            }
        }

I could say that cause a latency when you click to activate button for this feature.and stsadm -o copyappbincontent and ApplyApplicationContentToLocalServer() only copy the resource files on the local server.So
we have  options with Visual Studio 2010 and Sharepoint 2010

First  i will start with the easy way if you are using Sharepoint 2010 and Visual Studio 2010 .
1) Create an Empty Element from vs ide and rename it OurResources.
2) Add a resource file to this element named TestResource.resx
3) Select TestResource.resx and Change property value of  “Build Action”  key to “Resource” from Visual Studio IDE Properties window
4) Change property value of Deployment Type key to “AppGlobalResource”
5) Expand the “Deployment Location” and set the Path is empty .for doing that we can able to copy our resource file root folder of App_GlobalResources.

Second you can use ApplicationResourceFiles element on your Solution xml
<ApplicationResourceFiles> 
    <ApplicationResourceFile Location=”blog.resx”/> 
    <ApplicationResourceFile Location=”blog.en-US.resx”/> 
  </ApplicationResourceFiles>

But what if you are developing a farm scope feature or webapplication scope features that should add extra resource file to selected web applications or you have multiple server farm and you want to deploy resource files accross the farm .This time you may need a TimerJob for deploying your resource files.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using Microsoft.SharePoint.Administration;
using Microsoft.SharePoint;
using Microsoft.SharePoint.Utilities;
using System.IO;

namespace ResourceDeployment
{

    public class DeployResourcesJob : SPJobDefinition {
        public readonly static string DefinitionName = "job-deploy-resources";

        #region Constructors
        public DeployResourcesJob() : base() { }
        public DeployResourcesJob(SPWebApplication webApp) : base(DeployResourcesJob.JobDefinitionName, webApp, null, SPJobLockType.None) {
            this.Title = "Deploy Resource Files";
        }
        #endregion

        public static void ActivateJob(SPWebApplication webApp) {
            // Delete if any existing jobs
            DeployResourcesJob.Delete(webApp.JobDefinitions, JobDefinitionName);

            DeployResourcesJob job = new DeployResourcesJob(webApp);
            job.Schedule = new SPOneTimeSchedule(DateTime.Now.AddHours(-2));
            job.Update();
        }

       public static void RemoveJob(SPJobDefinitionCollection jobDefinitions, string name) {
           DeployResourcesJob existingJob = jobDefinitions.GetValue(DeployResourcesJob.JobDefinitionName);
            while (existingJob != null)
            {
                existingJob.Delete();
                existingJob.Unprovision();
                existingJob = jobDefinitions.GetValue(DeployResourcesJob.JobDefinitionName);
            }
        }

       public override void Execute(Guid targetInstanceId) {

             string source = SPUtility.GetGenericSetupPath("Resources");
            // Copy or remove the resource file for all zones
            if (Directory.Exists(source)) {
                foreach (SPUrlZone zone in this.WebApplication.IisSettings.Keys) {

                    // Get the location of the App_GlobalResources folder under the target Web Application
                    string destination = this.WebApplication.GetIisSettingsWithFallback(zone).Path + "\\App_GlobalResources";

                    if (Directory.Exists(destination)) {
                        string[] resourceFiles = Directory.GetFiles(source, "MyResource*.resx");
                        foreach (string filename in resourceFiles)
                        {
                            string destinationFilename = destination + "\\" + Path.GetFileName(filename);
                            File.Copy(filename, destinationFilename, true);

                        }
                    }

                }
            }
        }

}
}

Here Some Resources:
http://blogs.msdn.com/b/johnwpowell/archive/2009/11/29/sharepoint-2010-localization-with-visual-studio-2010.aspx
http://blogs.msdn.com/b/maximeb/archive/2008/04/26/deploying-resource-files-across-a-farm.aspx
http://cicoria.com/cs1/blogs/cedarlogic/archive/2010/01/31/deployment-of-resource-files-resx-to-app-globalresources-under-sharepoint.aspx

End of Article 🙂

Quick tip for relative paths using Style Library

Here is very good definition from msdn about usage of Style Library :

“In Office SharePoint Server 2007, the publishing features create a special document library, named the Style Library, which Microsoft uses to deploy standard CSS files and image files that are used in publishing sites. The Style Library is also commonly used as a deployment target by web designers and developers who are using CSS files and image files to apply branding elements to Office SharePoint Server 2007 publishing sites.

When you are developing a generic and reusable branding solution for SharePoint Server 2007 farms, you cannot use the Style Library because it exists only in publishing sites. Windows SharePoint Services 3.0 does not create the Style Library when you create other types of sites, such as a Team site, Blank site, or a Document Workspace. Fortunately, this is no longer a problem in SharePoint 2010.

In SharePoint 2010, every site collection has its own Style Library. That’s because Microsoft has moved the standard provisioning instructions for creating the Style Library out of the publishing features and into the Global site definition. Each time SharePoint Foundation 2010 creates a new site collection, it adds the Style Library to the top-level site. This makes the Style Library an ideal candidate for deploying CSS files and image files in a generic branding solution.”

Every web developer has faced with absolute or relative path problems for assets files.Working with relative paths makes you mad or Sometimes solution is using fullpath which is mostly problematic, ,sometimes needed extra codding etc. But what about Style Library:

For a bad example:
I assume that you have a masterpage file and bellowed line:

<asp:Image
ImageUrl="~/Style Library/CustomImages/BlogofBugra.jpg %>"
runat="server"
/>

For this scenario the image file can be shown from default.aspx or any root page no problem is here.
But if you open a system page for example _Layouts/settings.aspx . upss your images link are broken ….

To fix this issue using $SPUrl can help us
For a good examples:

<asp:Image
ImageUrl="<% $SPUrl:~sitecollection/Style Library/CustomImages/BlogofBugra.jpg %>"
runat="server"
/>

<SharePoint:CssRegistration
  name="<% $SPUrl:~sitecollection/Style Library/styles.css %>"
  After="corev4.css"
  runat="server"
/>