Security issue during installation

Post here for help with installing or upgrading mojoPortal pre-compiled release packages. When posting in this forum, please provide all relevant details. You may also want to review the installation or upgrading documentation.

If you have questions about using the source code or working with mojoPortal in Visual Studio, please post in the Developer forum.

Post here for help with installation of mojoPortal pre-compiled release packages

When posting in this forum, please try to provide as many relevant details as possible. Particularly the following:

  • What operating system were you running when the bug appeared?
  • What database platform is your site using?
  • What version of mojoPortal are you running?
  • What version of .NET do you use?
  • What steps are necessary to reproduce the issue? Compare expected results vs actual results.

You may also want to review the installation or upgrading documentation.

If you have questions about using the source code or working with mojoPortal in Visual Studio, please post in the Developer forum.

This thread is closed to new posts. You must sign in to post in the forums.
8/7/2009 10:46:00 AM
Gravatar
Total Posts 2
Vittorio

Security warning and other issues during installation

Hi all,

I've tried mojoPortal Demo yesterday and it was so great that I decided to start using it for all my sites (currently I create them manually by DreamWeaver ).

However I have been struggling all the day trying to solve an error during installation. I've tried all the tricks I could find, but now I am at a dead end and I must ask for help.

* What operating system? Windows 2003 Server - Internet Information Server (IIS) - Microsoft .NET Framework Version:2.0.50727.3082; ASP.NET Version:2.0.50727.3082
* What database platform? MySql 4.1.23-pro-gpl-log
* What version of mojoPortal? 2.3.1.3
 

Here are the steps I have done.

1. I downloaded mojoportal-2-3-1-3-mssql-deploymentfiles and then mojoportal-2-3-1-3-mysqldatalayer-GPL. Unzip the first and then overwrite the mysql.data.dll (and other files) using the files in the second zip. MySQL is installed on the server and the connection string has been changed accordingly in user.config.

I get this error (after changing Customerrors mode in Web.config in order to get more detailed error info):

Server Error in '/' Application.
--------------------------------------------------------------------------------

Cannot subset Regex. Only support if both patterns are identical.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NotSupportedException: Cannot subset Regex. Only support if both patterns are identical.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[NotSupportedException: Cannot subset Regex. Only support if both patterns are identical.]
System.Net.WebPermission.IsSubsetOf(IPermission target) +5166627
System.Security.PermissionSet.IsSubsetOfHelper(PermissionSet target, IsSubsetOfType type, IPermission& firstPermThatFailed, Boolean ignoreNonCas) +7522874
System.Security.PermissionSet.IsSubsetOf(PermissionSet target) +19
System.Security.SecurityManager.ResolvePolicy(Evidence evidence, PermissionSet reqdPset, PermissionSet optPset, PermissionSet denyPset, PermissionSet& denied, Boolean checkExecutionPermission) +7604146
System.Security.SecurityManager.ResolvePolicy(Evidence evidence, PermissionSet reqdPset, PermissionSet optPset, PermissionSet denyPset, PermissionSet& denied, Int32& securitySpecialFlags, Boolean checkExecutionPermission) +57

[FileLoadException: Could not load file or assembly 'DotNetOpenAuth, Version=3.1.0.9122, Culture=neutral, PublicKeyToken=2780ccd10d57b246' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)]
System.Reflection.Assembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection) +0
System.Reflection.Assembly.nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection) +43
System.Reflection.Assembly.InternalLoad(AssemblyName assemblyRef, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +127
System.Reflection.Assembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +142
System.Reflection.Assembly.Load(String assemblyString) +28
System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +46

[ConfigurationErrorsException: Could not load file or assembly 'DotNetOpenAuth, Version=3.1.0.9122, Culture=neutral, PublicKeyToken=2780ccd10d57b246' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)]
System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +613
System.Web.Configuration.CompilationSection.LoadAllAssembliesFromAppDomainBinDirectory() +203
System.Web.Configuration.CompilationSection.LoadAssembly(AssemblyInfo ai) +105
System.Web.Compilation.BuildManager.GetReferencedAssemblies(CompilationSection compConfig) +178
System.Web.Compilation.BuildProvidersCompiler..ctor(VirtualPath configPath, Boolean supportLocalization, String outputAssemblyName) +54
System.Web.Compilation.CodeDirectoryCompiler.GetCodeDirectoryAssembly(VirtualPath virtualDir, CodeDirectoryType dirType, String assemblyName, StringSet excludedSubdirectories, Boolean isDirectoryAllowed) +8809426
System.Web.Compilation.BuildManager.CompileCodeDirectory(VirtualPath virtualDir, CodeDirectoryType dirType, String assemblyName, StringSet excludedSubdirectories) +128
System.Web.Compilation.BuildManager.CompileResourcesDirectory() +31
System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +304

[HttpException (0x80004005): Could not load file or assembly 'DotNetOpenAuth, Version=3.1.0.9122, Culture=neutral, PublicKeyToken=2780ccd10d57b246' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)]
System.Web.Compilation.BuildManager.ReportTopLevelCompilationException() +58
System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +512
System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters) +729

[HttpException (0x80004005): Could not load file or assembly 'DotNetOpenAuth, Version=3.1.0.9122, Culture=neutral, PublicKeyToken=2780ccd10d57b246' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)]
System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +8890735
System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +85
System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr) +259

 

Searching in the Forum I get this post: http://www.mojoportal.com/Forums/Thread.aspx?pageid=5&mid=34&ItemID=3&thread=1778&pagenumber=1

So I do the following:

1. Rename Web.config file to Web.fulltrust.config
2. Rename Web.mediumtrust.config to Web.config
3. Make sure the App_Data folder exists and is writable by the web process user

Try again: Same error.

In the same page I read “ If you can get your host to install NeatUpload that is best, but it can be disabled by commenting out all references to it in the Web.config file and it will gracefully degrade to normal upload functionality.”
Since I can only use a File Manager or FTP on my folders in the provider’s system (i.e. I can’t install anything in system folders), I comment out all the references to NeatUplaod in Web.config.

Result: same error

I read that “ You would need to download the version signed with a strong name key from the MySQL site here: http://dev.mysql.com/downloads/connector/net/1.0.html”, so I go to that site and download the latest stable version: mysql-connector-net-6.0.4-noinstall. Unzip it and copy everything in bin folder.

Result: same error

Now I am so desperate that I decide to remove from the server the DotNetOpenAuth.dll, which causes the error, and I get this different error:

Server Error in '/' Application.
--------------------------------------------------------------------------------

Could not load file or assembly 'MySql.Data, Version=6.0.3.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.IO.FileLoadException: Could not load file or assembly 'MySql.Data, Version=6.0.3.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Assembly Load Trace: The following information can be helpful to determine why the assembly 'MySql.Data, Version=6.0.3.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d' could not be loaded.


WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure logging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog].

 

Stack Trace:


[FileLoadException: Could not load file or assembly 'MySql.Data, Version=6.0.3.0, Culture=neutral, PublicKeyToken=c5687fc88969c44d' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)]
mojoPortal.Data.DBTaskQueue.DeleteCompleted() +0
mojoPortal.Business.TaskQueue.DeleteCompleted() +5
mojoPortal.Web.WebTaskManager.StartOrResumeTasks(Boolean appWasRestarted) +62
mojoPortal.Web.Global.StartOrResumeTasks() +243
mojoPortal.Web.Global.Application_Start(Object sender, EventArgs e) +205

 

Try with mysql-connector-net- 5.2.7: same problem

Try with mysql-connector-net- 5.0.9.: same problem

I reinstall the original MySql.Data from mojo zip: It’s much better! However I still get a security exception:

Welcome to mojoPortal Setup
Verifica del sistema...
Privilegi del File system ok.

Il sistema non puo' connettersi al database MySQL. Prego, verificare la Stringa di Connessione.


MySql.Data.MySqlClient.MySqlException: Unable to connect to any of the specified MySQL hosts. ---> System.Security.SecurityException: Request for the permission of type 'System.Net.SocketPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed. at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet) at System.Security.CodeAccessPermission.Demand() at System.Net.Sockets.Socket.CheckCacheRemote(EndPoint& remoteEP, Boolean isOverwrite) at System.Net.Sockets.Socket.BeginConnectEx(EndPoint remoteEP, Boolean flowContext, AsyncCallback callback, Object state) at System.Net.Sockets.Socket.BeginConnect(EndPoint remoteEP, AsyncCallback callback, Object state) at MySql.Data.Common.StreamCreator.CreateSocketStream(IPAddress ip, Boolean unix) at MySql.Data.Common.StreamCreator.GetStream(UInt32 timeout) at MySql.Data.MySqlClient.NativeDriver.Open() The action that failed was: Demand The type of the first permission that failed was: System.Net.SocketPermission The Zone of the assembly that failed was: Internet --- End of inner exception stack trace --- at MySql.Data.MySqlClient.NativeDriver.Open() at MySql.Data.MySqlClient.Driver.Create(MySqlConnectionStringBuilder settings) at MySql.Data.MySqlClient.MySqlPool.CreateNewPooledConnection() at MySql.Data.MySqlClient.MySqlPool.GetPooledConnection() at MySql.Data.MySqlClient.MySqlPool.TryToGetDriver() at MySql.Data.MySqlClient.MySqlPool.GetConnection() at MySql.Data.MySqlClient.MySqlConnection.Open() at mojoPortal.Data.DBPortal.DatabaseHelperGetConnectionError(String overrideConnectionInfo)

Questo sito sembra operare in un ambiente protetto che usa policy Medium Trust o, almeno, inferiori a Full Trust.
Per utilizzare MySQL sotto Medium Trust, il connettore MySQL per .NET deve essere installato nella Global Assembly Cache del server. Se vedi una SecurityException nel messaggio di errore allora il connettore no ne' installato. You can download the MySql Connector for .NET from here: http://dev.mysql.com/downloads/connector/net/5.0.html

(Some of the texts are in Italian since I'm working with that language. The last paragraph is saying that the server is using a Medium Trust policy, and that I should download the mySql connector, but that's just what I have already done ).

Sorry for this long post, but I'd like to give you as many information as possible, so that someone can help me to get up and running.

Thank you very much!

 

 






 

8/7/2009 10:53:52 AM
Gravatar
Total Posts 18439

Re: Security issue during installation

Hi,

In order for MySql to work in Medium Trust the correct version of the MySql Connector must be installed in the GAC on the server. Either your host does not have it installed or they have a different version than the needed version. Its much easier to use MS SQL in Medium Trust because the needed drivers are installed in the GAC by default.

Sorry but I have no solution for you other than if your host will install the MySql Connector version 6.0.3.0 in the GAC or if you can switch to use MS SQL.

Hope it helps,

Joe

8/7/2009 12:25:01 PM
Gravatar
Total Posts 2
Vittorio

Re: Security issue during installation

Thank you very much, Joe, for your quick and clear answer.

I have no control on what my provider installs on the server. Furthermore, since I manage sites for my customers, even if my provider could install the right version in the GAC, I can't risk that everything goes down suddenly, simply because my host decides to change the version of this DLL. So I need to have the full control on the technical solution I choose.

So I have two options now:

1. Use a different CMS software. All my sites are based on ASP pages and some also use Access databases, so I must stay on a Windows platform, which is the reason why I was so interested in your product. I have looked at your competitors on this platform and their products don't seem as good as yours.

2. Migrate to a more expensive plan with my provider, which include several things I don't need but also a SQL Server database, and then use mojoPortal.

I will contact the provider and will let you know.

 

Thank you very much.

 

Vittorio

 

8/7/2009 12:34:33 PM
Gravatar
Total Posts 18439

Re: Security issue during installation

Some hosts if you ask them will move your site to a server that has Full Trust instead of Medium Trust. DiscountASP and CrystalTech, WebHostForASP all have this. Its worth asking your host though they may not have any servers configured for full trust.

In full trust it can use the dlls from the bin folder so you have control.

Hope it helps,

Joe 

You must sign in to post in the forums. This thread is closed to new posts.