Exception: Sitecore.Security.AntiCsrf.Exceptions.PotentialCsrfException
Message: CSRF form field is missing.
Source: Sitecore.Security.AntiCsrf
at Sitecore.Security.AntiCsrf.SitecoreAntiCsrfModule.RaiseError(Exception ex, HttpContext context)
at Sitecore.Security.AntiCsrf.SitecoreAntiCsrfModule.PreRequestHandlerExecute(Object sender, EventArgs e)
at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

The issue seemes to be related to an implementation of AntiCSRF, a Microsoft Public License library that prevents Cross Site Request Forgery.

HOW TO FIX IT:

The fix is easy. Clear your cookies, clear the browser cache, close the browser and try again.

UPDATE:

The clever guys at Sitecore Support have come up with this (untested) quick fix that you can try:

Please add these lines to the Sitecore.AntiCsrf.config file (website/app_config/include/Sitecore.AntiCsrf.config):

<ignore wildcard="/sitecore/shell/*Applications/Security/User*Manager*?*Cart_Users_Callback=yes"/>
<ignore wildcard="/sitecore/shell/*Applications/Security/Role*Manager*?*Cart_Roles_Callback=yes"/>
<ignore wildcard="/sitecore/shell/*Applications/Security/Domain*Manager*?*Cart_Domains_Callback=yes"/>
<ignore wildcard="/sitecore/shell/~/xaml/Sitecore.Shell.Applications.Security.SelectAccount*Cart_*_Roles_Callback=yes"/>
<ignore wildcard="/sitecore/shell/~/xaml/Sitecore.Shell.Applications.Security.SelectAccount*Cart_*_Users_Callback=yes"/>

UPDATE 2:

The tough guy could choose to disable AntiCSRF completely. Add the following line in the /App_Config/Include/Sitecore.AntiCSRF.config file:

<?xml version="1.0"?>
<configuration>
  <sitecore>
    <AntiCsrf>
      <rules>
        <rule name="shell">
          <!-- Ingore AntiCSRF completely -->
          <ignore wildcard="/sitecore/*"/>
        </rule>
      </rules>
    </AntiCsrf>
  </sitecore>
</configuration>

“user name is not valid in the selected domain.”

But do not worry, it’s not the underlying security framework that disallows email as username, it’s just a default validation of user names in the user manager dialog box.

The default validation is based on this regular expression: ^\w[\w\s]*$

You can change the regular expression using the AccountNameValidation setting. Add the following to your web.config:

<setting name="AccountNameValidation" value=".+" />

When using the users email address as username, you should consider changing the membership provider in Sitecore to require a unique email. Otherwise you risk having users that share email addresses.

The change is simple. Go to web.config and change the attribute “requiresUniqueEmail” to “true“:

<add name="sql"
type="System.Web.Security.SqlMembershipProvider"
connectionStringName="core"
applicationName="sitecore"
minRequiredPasswordLength="1"
minRequiredNonalphanumericCharacters="0"
requiresQuestionAndAnswer="false"
requiresUniqueEmail="true"
maxInvalidPasswordAttempts="256" />

Most of this release revolves around scalability and indexing. The Lucene index have been updated to allow even more impressive performance and even higher scalability. The old Sitecore 6 would easily swallow 1.000.000 items. Sitecore 7 have almost no limitations. Even on folder level, where the old Sitecore 6 stalled at around 200 items at the same level; Sitecore 7 implements a revamped version of Sitecore Item Buckets, allowing you to have an infinite amount of items at the same level.

So what’s next on my wish list? Could I ask for more? Of course. More wants more. Here is the areas where I would like Sitecore to focus on for the first update of Sitecore 7:

SITECORE PAGE EDITOR

AN EXTENSIBLE PAGE EDITOR

We need the Sitecore Page Editor to be extensible, like the rest of Sitecore.

If you wish to add a new field to the Sitecore shell, you write some code, put it in a DLL and points to the field. No modifications to Sitecore itself.

In the Page editor, you need to modify one of Sitecore’s own Javascript files (FieldChromeType.js). This file changes with every version of Sitecore, and you cannot just append your modifications, as you need to modify namespaces and switch statements.

This is bad and very Sitecore-unlike behavior. Sitecore is a platform. You never modify the platform. You extend it. Except for the page editor. Sigh.

PAGE EDITOR LINK FIELD TYPE NEEDS TO ALLOW LOOKUP FIELDS

If you would like to have a link popup box in the page editor, you must have a general link field. The page editor should have a popup for all lookup fields, so you can have fields where only internal links are allowed.

PAGE EDITOR SHOULD HAVE A BUTTON FOR THE MEDIA LIBRARY

A button that opened the media library would be nice please. It’s 10 lines of code. I can give you the code.

PAGE EDITOR SHOULD BE ABLE TO EDIT NON-VISUAL FIELDS

Not all fields are visible. But you should be able to edit them anyway. Thomas Stern made a solution. This should be standard.

PAGE EDITOR SHOULD BE ABLE TO PUBLISH EVERYTHING THAT’S INCLUDED ON THE PAGE

The publish button on the page editor will only publish the current item (and it’s subitems). But most pages have included components. These components are not stored on the item, and often not as children to the current item. When publishing from the page editor, these components should be published as well. Otherwise you cannot publish them from the Page Editor at all.

PAGE EDITOR SHOULD BE CHEAPER TO DEVELOP FOR

This is not a no-brainer. The Page Editor is the coolest thing since sliced bread. Customers are requesting page editable websites more and more often.

Unfortunately, if you are aiming at building a page-editor only website (a website that is edited completely using the page editor) costs explode. The number of lines explode, as you have to consider many more states and exceptions.

You have to add code to allow fields that is hidden if empty to be shown, only in page edit mode. And how do you make a carrousel page editable? And what about the metadata fields?

How do you allow the customer to version pages, if the page consists of components?

All of these simple, little decisions complicate your code, making it more expensive to develop, and more expensive to test.

SITECORE SHELL

ADDING COMPONENTS USING THE SHELL

If you wish to use the Sitecore DMS in it’s full extent you are bound to make a Page Editable website. Why? Because the Page Editor is the only place where you can add components to a page. Components are necessary if you would like to use A/B Testing and Real Time Personalisation.

We need the dialogs for adding components to a page available in the Sitecore Shell.

I would expect the Sitecore Shell to contain the full set of functions, and the Page Editor to be a subset of functionality.

Yes I know that I can use the Presentation->Details button to open the Layout Details and from there I can add my components. But my customer cannot. It’s a developer tool and way too complicated to use.

Please make a user friendly way of adding components to a page from the Sitecore Shell.

CODING

SC:FIELDRENDERER

The sc:FieldRenderer should be able to get a NULL item without crashing. This would remove half of my code lines in my components.

SC:LINK

The sc:Link should be able to use lookup fields and not only the general link field.

SC:EDITFRAME

The sc:EditFrame should accept a Sitecore item instead of a Item path in the DataSource property.

“Operation is not valid due to the current state of the object”

or:

“The URL-encoded form data is not valid”

WHY?

Microsoft released a Security update at dec 29 2012. The update contained (amongst other features) an upper bound to the number of simultaneous HTTP form elements that can be posted. The new limit is 1000.

In the Sitecore Page Editor you may experience that for large pages you have more than 1000 form elements.

WHAT TO DO?

To fix this you should add the following to the web.config:

In the <appSettings> of the web.config add the following:

<add key=”aspnet:MaxHttpCollectionKeys” value=”value greater than 1000” />

Thanks to Alin Parjolea for the tip.

The behavior is partially because of the way .net handles redirects internally. But fortunately you can overcome it pretty easily.

My colleague Anders Laub came up with this extension to the Sitecore httpRequestBegin pipeline.

By adding a processor to the pipeline you can switch the missing item with a 404 item inside Sitecore. The item in Sitecore will then have a sublayout that will throw the 404. In effect, Sitecore (or .net) will not know that there is a page missing and will continue the business as usual. It’s up to us developers to handle the 404. Just like we like it.

First the httpRequestBegin processor:

<httpRequestBegin>
  <processor type="Sitecore.Pipelines.PreprocessRequest.CheckIgnoreFlag, Sitecore.Kernel" />
  ...
  ...
  <processor type="Sitecore.Pipelines.HttpRequest.ItemResolver, Sitecore.Kernel" />
  <processor type="MyCode.Custom404ResolverPipeline, MyDll" />
  ...
  ...
</httpRequestBegin>

The processor is added just after the ItemResolver. The ItemResolver returns null if the item is not found.

We then switch the missing item with our 404 item:

public class Custom404ResolverPipeline : HttpRequestProcessor
{
  public override void Process(HttpRequestArgs args)
  {
    Assert.ArgumentNotNull(args, "args");

    // Do nothing if the item is actually found
    if (Sitecore.Context.Item != null || Sitecore.Context.Database == null)
      return;

    // all the icons and media library items 
    // for the sitecore client need to be ignored
    if (args.Url.FilePath.StartsWith("/-/"))
      return;

    // Get the 404 not found item in Sitecore.
    // You can add more complex code to get the 404 item 
    // from multisite solutions. In a production 
    // environment you would probably get the item from
    // your website configuration.
    Item notFoundPage = Sitecore.Context.Database.GetItem("{DFE03D7A-00B9-4C15-8AB7-482D82B3484E}");
    if (notFoundPage == null)
      return;

    // Switch to the 404 item
    Sitecore.Context.Item = notFoundPage;
  }
}

The page we switched to needs to have a sublayout that will do the actual 404 return code:

public partial class _404 : System.Web.UI.UserControl
{
  protected void Page_Load(object sender, EventArgs e)
  {
    HttpContext.Current.Response.StatusCode = (int)HttpStatusCode.NotFound;
    HttpContext.Current.Response.TrySkipIisCustomErrors = true;
    HttpContext.Current.Response.StatusDescription = "Page not found";
  }
}

Remember to set the TrySkipIisCustomErrors or your 404 page will be ignored by IIS 7.5.

MORE READING:

• Kern Herskind has another solution here.
• A Stackoverflow article on the same issue.
• Partech handles the issue as well.

The Sitecore Page Editor is build around the concept of components. A component is a reusable piece of data that is parred with a sublayout and placed in a placeholder.

Sitecore Page Editor’

This tutorial will create a very simple component: Adding an Image.

To create components you must go through a series of steps.

STEP 1: CREATE THE TEMPLATE

First you need a Sitecore Template where you store the data. My component must show an image, so all my template contains is an image field called “DocumentImage”:

Document Image Template

STEP 2: FIND A HOME FOR TEMPLATES OF THIS TYPE

Next step is to define a place in your web site structure where you will store templates of this type. Templates of different types can share a folder, or you can create a folder specifically for this type.

You will need the folder in a few steps.

STEP 3: CREATE A SUBLAYOUT

Now you need a sublayout that will present the data from the template.

Document Image Sublayout

When creating the sublayout you must determine the contents of these fields:

• Editable: Check this box. If unchecked, the sublayout is not editable and cannot be used in the Page Edittor as a component.
• Datasource location: Select the folder you chose in STEP 2. When the component is added to a page, this is where the data will be stored.
• Datasource template: Select the template you created in STEP 1. When the component is added to a page, this is the template that is created.

STEP 4: ASSIGN THE SUBLAYOUT TO A PACEHOLDER SETTING

Each placeholder that is capable of having controls added must be defined in the folder /sitecore/layout/Placeholder Settings.

Select the placeholder setting where you would like to allow your control to be added and add it to the “Allowed controls” field:

Placeholder setting

Read more about placeholder settings here.

STEP 5: CODE THE CONTENTS OF THE SUBLAYOUT

When a component is added to a page it is parred to a item through the “datasource” parameter on the layout. This means that you cannot get the data for your component with Sitecore.Context.Item. Sitecore.Content.Item will point to the actual page where the component is added, not the item assigned to the component.

The following method will get the item from the “datasource”, with a fallback to the current item. The fallback is a safety mechanism that ensures that the item returned is never null, as this will crash the entire web page.

protected Item CurrentContextItem
{
  get
  {
    Sublayout thisSublayout = (Parent as Sublayout);
    if (thisSublayout == null)
      return Sitecore.Context.Item;
    if (string.IsNullOrEmpty(thisSublayout.DataSource))
      return Sitecore.Context.Item;
    string dataSource = thisSublayout.DataSource;
    Item dataSourceItem = Sitecore.Context.Database.GetItem(dataSource) ??
                          Sitecore.Context.ContentDatabase.GetItem(dataSource);
    if (dataSourceItem == null)
      return Sitecore.Context.Item;
    return dataSourceItem;
  }
}

(This method of getting the datasource has not changed the last 5 years).

You now assign the Item parameter of the sc:Image webcontrol to CurrentContextItem, and the control will take its data from that item:

<%@ Control Language="C#" AutoEventWireup="true" CodeBehind="DocumentImage.ascx.cs" Inherits="PT.Document.DocumentImage" %>
<%@ Register TagPrefix="sc" Namespace="Sitecore.Web.UI.WebControls" Assembly="Sitecore.Kernel" %>

<div class="Image">
  <sc:Image field="DocumentImage" id="Image" runat="server" Item="<%# CurrentContextItem %>" MaxHeight="200" />
</div>

If your component uses an EditFrame you need to get the actual value from the datasource, not the item it points to. In this case you need another method:

protected string DataSourceValue()
{
  Sublayout sublayout = (Parent as Sublayout);
  return (((sublayout == null) || string.IsNullOrEmpty(sublayout.DataSource)) ? string.Empty : sublayout.DataSource);
}

You can now use this method to ensure your EditFrame uses the correct item:

<sc:EditFrame runat="server" ID="editFrame" Buttons="???" DataSource="<%# DataSourceValue %>">
  ...
  ...
</sc:EditFrame>

That’s all there is to it. Happy coding.

More reading:

• Sitecore Recommended Practices – part 6 (Presentation,Page Editor, and Solution Code) by Dan Brown.
• Presentation component reference (PDF Document by Sitecore)

PDF icon Missing

In this case it is only my test server that is not showing the icons. My local development machine (my own laptop) displays the icons perfectly:

PDF icon Shown on my laptop

The reason is that Siteore use the associated icon from the OS. Acrobat Reader is installed on my laptop, not on my test server. So the test server displays a default icon instead.

WHAT’S THE SOLUTION THEN?

You can specify which static file to use for which extension in the web.config. To add the PDF icon, do the following:

Download a .pdf icon from the Adobe Website (due to licensing restrictions, Sitecore is not shipped with an Acrobat Reader icon). Place the icon wherever you wish.

Go to the web.config and find the <mediaType name=”PDF file” extensions=”pdf”> section.

Add the following:

<mediaType name="PDF file" extensions="pdf">
  <mimeType>application/pdf</mimeType>
  <forceDownload>false</forceDownload>
  <sharedTemplate>system/media/unversioned/pdf</sharedTemplate>
  <versionedTemplate>system/media/versioned/pdf</versionedTemplate>
  <!-- New section -->
  <thumbnails>
    <generator type="Sitecore.Resources.Media.MediaThumbnailGenerator, Sitecore.Kernel">
      <extension>png</extension>
    </generator>
    <staticFile>File location. For example /sitecore/shell/Themes/pdficon_large.png</staticFile>
  </thumbnails>
  <!-- end:New section -->
</mediaType>

Clear the following folders:

• /temp/ folder (at least all files named “fileIcon”)
• The Sitecore media cache (default located at /app_data/mediacache/)

Clear your browser cache.

Restart the website.

That’s it. You now have PDF icons in Sitecore.

MORE READING:

• Adding custom icons for the media library
• Sitecore forum post on missing PDF icons

Save Dialog

This scenario can occur if the contents of any multiline field or textbox field contains new lines \n or carriage returns \r.

Memo Box with \r or \n

In rare situations, the browser will interprete \n and \r differently from Sitecore, thus telling Sitecore that the contents in the box differs from the contents in the Sitecore database.

The situation rarely occurs with manually entered text, but if you have programatically added the text to the box, the \n and \r might misalign.

So if you add text to the multiline field (or textbox field) you should ensure that any \n and \r are removed before adding the text.

I made this string extension method to remove all new lines, carriage returns, tabs and strange \xA0′s (which looks like a space but isn’t):

public static string CleanNewLinesTabsAndOtherStuff(this string s)
{
  return s.Replace("\r\n", " ").Replace("\r", " ").Replace("\n", " ").Replace("\t", " ").Replace('\xA0', '\x20');
}

I replace all of them with spaces, but in other situations you could replace them with string.Empty.

But Sitecore also provides its own Security framework that you can use for easy manipulation of users and roles seen from a Sitecore perspective.

BASICS OF SITECORE SECURITY

There is 2 things you need to know about Security in Sitecore:

• Sitecore prefixes user names with a domain name. This is used to differentiate users between those with access to the Sitecore editor (domain: sitecore) and those with access to the Sitecore extranet (domain: extranet).
  So when accessing Sitecore users from System.Web.Security, make sure you remember to ask for sitecore\admin, and not admin.
  (Advanced Sitecore users know that you can create as many domains as you like).
• In Sitecore there is no such thing as “not been logged in”. If you are not logged in, you will have a user called “extranet\Anonymous“.
  This means that you will always have a user, no matter the context you are running in.

ENOUGH TALK, LETS CODE

Get a user from the domain name, user name and password:

using System.Linq;
using Sitecore.Common;
using Sitecore.Security;
using Sitecore.Security.Accounts;

namespace PT.Framework.NemLogin
{
  public class UserRepository
  {
    /// <summary>
    /// Gets the <see cref="Sitecore.Security.Accounts.User"/>.
    /// </summary>
    /// <param name="domainName">Name of the domain.</param>
    /// <param name="userName">Name of the user.</param>
    /// <param name="password">The password.</param>
    /// <returns><see cref="Sitecore.Security.Accounts.User"/> if found or null if not found</returns>
    public static User GetUser(string domainName, string userName, string password)
    {
      if (!System.Web.Security.Membership.ValidateUser(domainName + @"\" + userName, password))
        return null;
      if (User.Exists(domainName + @"\" + userName))
        return User.FromName(domainName + @"\" + userName, true);
      return null;
    }
  }
}

The above function demonstrates how you can use the System.Web.Security and the Sitecore.Security namespace simultaneously. The function first validates the user using standard .NET security, then uses the Sitecore namespace to get the user.

Login:

The following function will do a login of a specified user:

using Sitecore.Security.Accounts;

using Sitecore.Security.Authentication;
using Sitecore.Web.Authentication;

public static bool Login(string domainName, string userName, string password)
{
 return AuthenticationManager.Login(domainName + @"\" + userName, password, false);
}

And this function will also do a login, but it utilizes the Sitecore TicketManager. The TicketManager manages persistent logins and is used to remember you when you log into the Sitecore backend:

public static bool Login(User user)
{
  string ticketID = TicketManager.GetCurrentTicketId();
  if (!string.IsNullOrEmpty(ticketID))
    TicketManager.RemoveTicket(ticketID);
  return AuthenticationManager.Login(user);
}

Managing Custom Properties on User Profiles:

This is an example on how to store custom data on a user profile, and later search for the user based on the value in the custom field:

#region

using System.Linq;
using Sitecore.Common;
using Sitecore.Security;
using Sitecore.Security.Accounts;

#endregion

namespace MyCode
{
  public class UserRepository
  {
    public static User GetUserFromCustomField(string fieldName, string fieldValue)
    {
      IFilterable<User> allUsers = UserManager.GetUsers();
      return allUsers.Where(user => user.Profile.GetCustomProperty(fieldName) == fieldValue).FirstOrDefault();
    }

    public static void SetCustomField(User user, string fieldName, string fieldValue)
    {
      UserProfile profile = user.Profile;
      profile.SetCustomProperty(fieldName, fieldValue);
      profile.Save();
    }
  }
}

Read more here:

• Sitecore Security API Cookbook – The essential reading
• Sitecore Membership Providers – The next book you will read
• Working with custom user profiles by Learn Sitecore
• Setting up a Sitecore Extranet by Mark Stiles
• Virtual Users in Sitecore 6 by iStern
• Setting up Security on Languages by briancaos
• Assigning Security to items by briancaos

Usually we use the Sitecore Pagkage Designer to pack contents into a package that can be installed on another Sitecore. But sometimes that’s not the best solution.

MIGRATING HUGE AMOUNTS OF DATA

Yesterday I had to move 28.000 items + 16 GB of Media Library contents from development to test.

The packager will not support this amount of contents. A Sitecore package is basically a .zip file with serialized Sitecore items. Each item is a file inside the .zip file.

I tried to create a package containing my 28.000 items, but the size of the zip file grew bigger than 2 GB which caused the package to fail.

HOW TO EASILY MIGRATE 16+GB OF DATA – THE INITIAL SETUP

Instead of creating one (or several) packages of data I create one package containing the “basics” of the project to migrate, i.e.:

• New Templates (adding dynamically from /sitecore/templates)
• New Layouts (adding dynamically from/sitecore/layouts)
• New System settings (adding dynamically from /sitecore/system)
• New …

Furthermore i add the ROOT node of the contents to migrate:

• The root node of the Media Library folder I used to create my media library items
• The root node of the contents to move

Adding root nodes only

The package is now substantially smaller, about 1 Mb  which is a great size for a package. It installs fast and is easy to move around.

This package is installed on the destination Sitecore.

MOVING THE 16+GB DATA

Now I am ready to migrate the actual contents. As said before, 16 GB of data is not easily movable. Unless you use … the Sitecore tree serializer!

The Sitecore serializer can be found on the “Developer” tab. Right click the tabs and select the Developer tab:

Right click to select the Developer Tab

Select the item to serialize and click the “Serialize Tree” button:

Serialize Tree

Now Sitecore is serializing the item + all sub items into separate files on your hard drive  usually in the /app_data/serialization folder:

Serialized Data

It will take some time. (It took me 3 hours to generate 16 GB media library items in 12.000 individual files.)

When it’s finished, copy the files to your destination Sitecore machine, and reverse the process by selecting the root node you included in your package and clicking “Revert Tree”:

Revert Tree

It will take a LOT of time if you have 16+gb of data. But don’t worry, Sitecore is creating a Sitecore Job to de-serialize the data. So you can close the browser while the process is running.

When the job is done you can remove the serialized files from the source and destination machines.