Thanks rangler2, that is now fixed 👍

Thanks for pointing that out - Fixed ✅

@Tim, sure thing, here's a diff:

So it is only FieldType.FileUpload.cshtml.

Thanks for the quick response! Oke clear will do that.

We updated the blog post as well with this info! 👍

We didn't change any diffs.

You can see that we changed exactly 2 lines in the views:

I suspect that your team has updated ~\Views\Partials\Forms\Fieldtypes\FieldType.FileUpload.cshtml or ~Views\Partials\Forms\Themes\default\Fieldtypes\FieldType.FileUpload.cshtml directly to add those diffs, while we usually encourage copying views into a custom theme folder (but I don't know which version you're on so I can't say for sure if theming is available for you).

In any case, you can update any FieldType.FileUpload.cshtml file you can find and add a using statement: @using Umbraco.Forms.Core.Providers.FieldTypes and update the line:

var fileName = filePath.Split('/').Last();

to

var fileName = filePath.Split(new[] { FileUpload.EncryptedFilePathAndFileNameSeparator }, StringSplitOptions.None).Last();.

That should do the trick. So in your case, still copy all the files over, except for the files in ~/Views, update the FieldType.FileUpload.cshtml files manually and you should be up and running.

Thanks Sebastiaan, for confirming no layout changes on your end.

It quenched the doubt I already had and I went ahead and cherry-picked a few lines from the old version of ~Views\Partials\Forms\Themes\default\Fieldtypes\FieldType.FileUpload.cshtml as you suspected (and one other file).

It's looking good now. Sorry for the moment of panic.

Guess we'll have to talk internally about how to handle customizations :-).

@nutty - yes, use UmbracoContour.files.3.0.32 for your v7 updates.

What about v6?

Actually it's the same for v6.

And the same for v4 as well :-)

@Jesper I am guessing that's a site that is still running on .NET 4.5. You can install the following package first: https://our.umbraco.com/packages/developer-tools/codesharetls12umbraco/

Or otherwise, drop this as RegisterEvents.cs into App_Code:

using System.Net;
using Umbraco.Core;

namespace CodeShare.TLS1._2.Umbraco.EventHandlers
{
    public class RegisterEvents : ApplicationEventHandler
    {
        protected override void ApplicationStarted(UmbracoApplicationBase umbracoApplication, ApplicationContext applicationContext)
        {
            if (ServicePointManager.SecurityProtocol.HasFlag(SecurityProtocolType.Tls12) == false)
            {
                ServicePointManager.SecurityProtocol = ServicePointManager.SecurityProtocol | SecurityProtocolType.Tls12;
            }
        }
    }
}

Code from: https://github.com/prjseal/CodeShare.TLS1.2.Umbraco/blob/master/CodeShare.TLS1.2.Umbraco/EventHandlers/RegisterEvents.cs

Committing the license file makes it skip the call to umbraco.com and prevents the YSOD as well. Thanks though!

Ah! Of course, I missed that you actually put the solution in there! 👍

Hi Jesper.

We too have the same error message on a site which is running the free Forms license.

I have installed the 'code share tls 12 umbraco' package as suggested by Sebastiaan,

We overwrote the files contained in the patch, we also overwritten the UmbracoForms.config file with a back up of the original pre patch one just to be safe.

After the patch is applied we get the same error message as you.

Do you have any suggestions how we can resolve this?

We are currently running "7.0.4" and are patching up to '7.0.7' -

Many thanks in advance

Ensure that you have the umbracoForms.lic file in your bin folder (or wherever else it may be configed to be: https://our.umbraco.com/documentation/Add-ons/The-Licensing-model/#alternative-license-location)

It is fine if it is a completely empty file. My issue was it was not tracked by Git, so while I had it locally it wasn't there on my production server after a deployment.

@rangler2 Ah, I see in older versions we stored forms in the database differently! You can use the following query instead, I'll get the blog post updated:

SELECT * FROM [UFFields] WHERE [Fieldtype] = '84a17cf8-b711-46a6-9840-0e4a072ad000'

Hi, Thanks, however it seems because our install has been customised to store form definitions in blob storage as per

https://our.umbraco.com/Documentation/Extending/FileSystemProviders/Azure-Blob-Storage/index-v7

So for us the UFFields table is not present in the database. I was able to download the forms definitions from the forms folder in blob storage and then search those files for 84a17cf8-b711-46a6-9840-0e4a072ad000 to locate the upload fields.

Thanks Andy

Thanks @Alex, this is a nice-to-have update and not critical relating to this security update.

Good to know. I thought uploading a carefully crafted js file seemed like a plausible security issue.

Thanks for the professional handling of the issue and the advanced warning. This is much appreciated. 👍

Yep, we discovered the same this morning and have amended the blog post to also check the stated version in version file if it exists.

In this wonderful world of legacy we didn't remember the multiple different ways that we've used to display the version number in the dashboard. 🙈

Here is the Error in my log files:

ERROR Umbraco.Forms.Web.Editors.UpdatesController - Unhandled controller exception occurred System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel. at System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) at System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar)

Thanks Sebastian, so I can revert to he previous Umbraco forms package?

• I did store off my config file, and after the package was installed I used restored the original UmbracoForms.config file that I had saved off from my solution.

Also, I did a compare on the config files - the only difference in the UmbracoForms.config file is the version which I manually updated per the documentation of the security advisory. Thanks for any additional insight you can give on this!

You don't need to revert, but you can try if that works. But it sounds like you don't have a license file in place, I also put a workaround in for that error, so maybe that will help and maybe you can check if your FileUpload.cshtml files are in place.

The best thing to do is take your local version and compare the files in there to the .Files download you can find on the package downloads and see if you missed anything.

Posting a more complete error with full stacktrace will likely help 🙂

Of course, thanks @Jesper:

2021-07-20 18:13:57,214 [P6456/D4/T47] WARN umbraco.macro - Error loading Partial View (file: ~/Views/MacroPartials/InsertUmbracoForm.cshtml). Exception: System.Web.HttpException (0x80004005): Error executing child request for handler 'System.Web.Mvc.HttpHandlerUtil+ServerExecuteHttpHandlerAsyncWrapper'. ---> System.Web.HttpCompileException (0x80004005): d:\home\site\wwwroot\Views\Partials\Forms\Fieldtypes\FieldType.FileUpload.cshtml(17): error CS0104: 'FileUpload' is an ambiguous reference between 'Umbraco.Forms.Core.Providers.FieldTypes.FileUpload' and 'Microsoft.Web.Helpers.FileUpload' at System.Web.Compilation.AssemblyBuilder.Compile() at System.Web.Compilation.BuildProvidersCompiler.PerformBuild() at System.Web.Compilation.BuildManager.CompileWebFile(VirtualPath virtualPath) at System.Web.Compilation.BuildManager.GetVPathBuildResultInternal(VirtualPath virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate) at System.Web.Compilation.BuildManager.GetVPathBuildResultWithNoAssert(HttpContext context, VirtualPath virtualPath, Boolean noBuild, Boolean allowCrossApp, Boolean allowBuildInPrecompile, Boolean throwIfNotFound, Boolean ensureIsUpToDate) at System.Web.Compilation.BuildManager.GetVirtualPathObjectFactory(VirtualPath virtualPath, HttpContext context, Boolean allowCrossApp, Boolean throwIfNotFound) at System.Web.Compilation.BuildManager.GetCompiledType(VirtualPath virtualPath) at System.Web.Mvc.BuildManagerCompiledView.Render(ViewContext viewContext, TextWriter writer) at Umbraco.Core.Profiling.ProfilingView.Render(ViewContext viewContext, TextWriter writer) at System.Web.Mvc.Html.PartialExtensions.Partial(HtmlHelper htmlHelper, String partialViewName, Object model, ViewDataDictionary viewData) at ASP.PageViewsPartialsFormsFormcshtml.Execute() in d:\home\site\wwwroot\Views\Partials\Forms\Form.cshtml:line 89 at System.Web.WebPages.WebPageBase.ExecutePageHierarchy() at System.Web.Mvc.WebViewPage.ExecutePageHierarchy() at System.Web.WebPages.WebPageBase.ExecutePageHierarchy(WebPageContext pageContext, TextWriter writer, WebPageRenderingBase startPage) at Umbraco.Core.Profiling.ProfilingView.Render(ViewContext viewContext, TextWriter writer) at System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList1 filters, ActionResult actionResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>cDisplayClass21.1e(IAsyncResult asyncResult) at System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) at System.Web.Mvc.Controller.

In your file d:\home\site\wwwroot\Views\Partials\Forms\Fieldtypes\FieldType.FileUpload.cshtml

Did you remember the new using statement at the top?

@using Umbraco.Forms.Core.Providers.FieldTypes

You bet, this is my FileUpload.cshtml file:

@using Umbraco.Forms.Core.Providers.FieldTypes
@model Umbraco.Forms.Mvc.Models.FieldViewModel

@{
    var isValid = (Model.Mandatory && Model.Values != null && Model.Values.Any()) || (!Model.Mandatory);
}
<input type="file" name="@Model.Name" id="@Model.Id" multiple
       data-val="@(isValid == false ? "true" : null)"
       data-val-required="@(isValid == false ? Model.RequiredErrorMessage : null)" />

@if (Model.Values != null && Model.Values.Any())
{
    <p>
        <strong>Current File/s:</strong><br />
        @foreach (string filePath in Model.Values)
        {
            var fileName = filePath.Split(new[] { FileUpload.EncryptedFilePathAndFileNameSeparator }, StringSplitOptions.None).Last();

            <a>@fileName</a><br />
            <input type="hidden" name="@(Model.Name)_file_@(fileName)" value="@filePath" />
        }
    </p>
}

And you're sure this is the one from the path specified?

d:\home\site\wwwroot\Views\Partials\Forms\Fieldtypes\FieldType.FileUpload.cshtml

Because there are a few copies of that file in the theme folder as well 🙂

Otherwise it is a pretty strange error. You could try to specify the namespace, so the line with issues becomes:

var fileName = filePath.Split(new[] { Umbraco.Forms.Core.Providers.FieldTypes.FileUpload.EncryptedFilePathAndFileNameSeparator }, StringSplitOptions.None).Last();

@Jesper

Explicitly typing the call with

Umbraco.Forms.Core.Providers.FieldTypes.FileUpload.EcryptedFilePathAndFileNameSeparator 

Did the trick, thank you so much for sticking with me on this error and helping troubleshoot. Many, many thanks.

Brian

Just wanted to add that I too am running into the ambiguous reference error. Fully qualifying the name (Umbraco.Forms.Core.Providers.FieldTypes.FileUpload.EncryptedFilePathAndFileNameSeparator) solved the problem, but good to be aware of it since multiple unrelated people are being affected. May be worth a note in the blog post.

@Joël Depends on your version, on v7/v8 it will be encryptedFilePath.DecryptWithMachineKey() which is using StringExtensions in Umbraco.Core.

Probably should've mentioned the version but its 8.7.6.

Thx for the reply, I will try it out today!

Oke so I tried it out already and on DecryptWithMachineKey() im getting the following error:

"System.ArgumentException: Invalid value for 'encryptedTicket' parameter."

I have googled around and can't really find a matching case so I'm not sure what to do here.

There is no machineKey inside my Web.config and I don't know if its needed

@Joël please email me: [email protected] - this is a bit beyond what we should deal with on this thread :-)

Did this get resolved? We are having a problem with an older build whereby the uploaded files path is encrypted and we can't get it back out again?

@Ismael - did you maybe forget to update Views\Partials\Forms\Fieldtypes\FieldType.FileUpload.cshtml ?

@Tracey - probably need to bump the ClientDependency version in ~/Config/ClientDependency.config - just make it 1 higher.

Make sure to commit all the file, everything fits together. If your source control shows the files are not changed then it shouldn't ask you to check them in right?

Thanks Sebastiaan

The ClientDependency.Config version did change.

Unfortunately my source control (TFS) is trying to check in unchanged files too.

I am going to try it again from fresh - see how it goes

@Tracey Hmm, well, try to revert everything, if that helps something is really wrong.. we didn't update any of the frontend files. My guess is it might not have worked for you in the first place? 🙈

These are the files that changed between 6.0.8 and 6.0.9, so only the dlls and 2 of the Views files

Thanks @Sebastiaan, that's really helpful. I ran it again from fresh and it works so there must have been something up with my original code - apologies

@Tracey Great to hear, no need to apologize!

Thanks @Sebastiaan the patch has fixed the media path issue!

Cheers Ismael.

Thanks, can also confirm this fixed the issue for us also :)

Is this updated DLL now present in the downloadable packages as well?

I am afraid to tell that the Umbraco.Forms.Core.Providers 6.0.10 is still not saving the correct path as usual.

It only save the file to the form folder but not saving to the record value GUID folder. This would cause file overwritten if saving another record with the same file name or the edit record issue (the field may not able to load the saved file in the edit mode).

6.0.8 Before Patch: ~/media/forms/upload/form_7891e1b6-84bd-49ca-9876-18d6302a1663/05f10198-59f1-41c3-9bb3-b81415639502/my-file.csv

6.0.9 After Patch: ~/media/forms/upload/form7891e1b6-84bd-49ca-9876-18d6302a1663/om.au/mysite/appdata/temp/fileuploads/8aeee0a5-ba03-4a3b-8465-7cc8a6a92f54/my-file.csv

6.0.10 After Patch: ~/media/forms/upload/form_7891e1b6-84bd-49ca-9876-18d6302a1663/my-file.csv

Oof keio-equ is correct, I am seeing the same. Would expect the record subfolder to be used.

I've had the same problem in 4 different projects, strange thing is that it does NOT occur on every applied patch, i've had upgrades from 4.4.7 to 4.4.8 go well and now also one that does F up the path.

I fixed it for v6.0.9 in a project implementing a FileUpload override on the fieldtype. Overriding the ConvertToRecord method

public override IEnumerable<object> ConvertToRecord(Field field, IEnumerable<object> postedValues, HttpContextBase context)
    {
        List<object> list = new List<object>();
        foreach (object current in postedValues)
        {
            if (current != null && !string.IsNullOrEmpty(current.ToString()))
            {
                string text = IOHelper.MapPath(this.DecryptFilePath(current.ToString()));
                string arg = context.Request["FormId"];

                var startindex = text.LastIndexOf(Configuration.UploadTempPath.Substring(Configuration.UploadTempPath.LastIndexOf("/") + 1), StringComparison.OrdinalIgnoreCase);
                string arg2 = text.Substring(startindex);
                string text2 = Configuration.UploadPath;
                if (SemVersion.Parse(Configuration.Version, false) < new SemVersion(4, 4, 0, "", ""))
                {
                    text2 = text2.Substring(8);
                }
                string text3 = string.Format("{0}/form_{1}/{2}", text2, arg, arg2).ToLower(CultureInfo.InvariantCulture);
                MediaFileSystem fileSystemProvider = FileSystemProviderManager.Current.GetFileSystemProvider<MediaFileSystem>();
                if (File.Exists(text))
                {
                    using (Stream stream = File.OpenRead(text))
                    {
                        fileSystemProvider.AddFile(text3, stream);
                    }
                    FileInfo fileInfo = new FileInfo(text);
                    if (fileInfo.Directory != null && Directory.Exists(fileInfo.Directory.FullName))
                    {
                        File.Delete(text);
                        Directory.Delete(fileInfo.Directory.FullName);
                    }
                    list.Add(fileSystemProvider.GetUrl(text3));
                }
            }
        }
        return list;
    }

The main part is making fixing the "arg2" variable which is done with the 2 lines.

var startindex = text.LastIndexOf(Configuration.UploadTempPath.Substring(Configuration.UploadTempPath.LastIndexOf("/") + 1), StringComparison.OrdinalIgnoreCase);
string arg2 = text.Substring(startindex);

@MickTemp / @Tim / @keio-equ - did any of you try the latest dlls and did they work for you as expected now? If so we'll create a new release with that fix next week. Thanks!

Hi Sebastiaan,

Yes, tested and applied the latest 6.0.10. Now it is working as expected.

Thank you so much for your help.

Hi Sebastiaan,

Late reply, been flat out. Can also confirm this is working as expected, thanks.

@Anson - You need to use a diff tool like WinDiff or BeyondCompare to have a look at what files have changed between those versions. In the patch releases from 7.4.2 to 7.4.3 and from 7.0.6 to 7.0.7 only the Upload view has changed as you can see in the diff view I posted a bit earlier in this thread.

@Ian seems to work now, looks like you got it fixed! 👍

@Ian I don't know, none of that code was touched.

I do notice you're using recaptcha v2 and I believe that one is pretty broken to begin with (on Google's end).
In version 7.5 of Forms we added support for Recaptcha 3, which is what we recommend you use.

Thanks @sebastiaan I will give that a try :)

@Dale this is out of scope for this thread.

I don't think we have good steps to upgrade. I found this thread:

https://our.umbraco.com/forum/umbraco-forms/92077-upgrade-contour-to-forms

Which links to other threads that could get you from Contour to Forms version 4, from which you should be able to upgrade to later versions.

However some of these links are dead, so we'll need to ask archive.org for help:

https://web.archive.org/web/20151024210147/https://our.umbraco.org/projects/developer-tools/umbraco-forms-migration/computer-says-no/59800-Steps-to-use

The migration tool leads to this GitHub repo for the source: https://github.com/TimGeyssens/ContourToUmbracoFormsMigrator - so if it doesn't work there's some debugging to do.

Ultimately, I would say you're probably better off starting fresh with a new install of Forms and manually recreating the forms you previously had (yes I know, if there's a 100 of them that might not be the easiest 🙂).

In any case: we don't have anything good for that and don't have any support available for it either I'm afraid.

Hey Sebastiaan,

So just to clarify there is no easy way for me to be able to upgrade Contour from 3.0.15 to the latest patch 3.0.32?

And the approach i should take is to install a fresh copy of Umbraco forms and re-create those forms?

Cheers Dale

Ah, no that's not what I thought you were asking!

Updating from Contour 3.0.15 to 3.0.32 is a matter of copying files over, as described in the blog post under the heading .

I thought you wanted to use Umbraco Forms instead of Contour.

Found the issues. The problem in the backoffice was due to a-tags being in use and a fix for that was posted in https://github.com/umbraco/Umbraco.Forms.Issues/issues/317. The reason for one of the forms text-area field was behaving strangely was because of the property preValues in the forms json-file had values and wasn't empty.

The problem was the package mediaprotect 1.6 which where not compatible with the new path.

It was not used on this specific site anymore, so I just removed the package.