From c8714aab291371ed3bdc0be3d6fc1dd817015a55 Mon Sep 17 00:00:00 2001
From: David Poindexter <dpoindexter@nvisionative.com>
Date: Fri, 8 Sep 2023 16:13:46 -0400
Subject: [PATCH] Update web.config max upload size defaults, correct backend
 calcs, and fix validation issue preventing increase

---
 DNN Platform/Library/Common/Utilities/Config.cs            | 4 +---
 DNN Platform/Tests/App.config                              | 2 +-
 DNN Platform/Website/development.config                    | 7 ++++++-
 DNN Platform/Website/release.config                        | 7 ++++++-
 .../Services/SecurityController.cs                         | 2 +-
 5 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/DNN Platform/Library/Common/Utilities/Config.cs b/DNN Platform/Library/Common/Utilities/Config.cs
index 83ba6b19af2..b1ccfe49c19 100644
--- a/DNN Platform/Library/Common/Utilities/Config.cs	
+++ b/DNN Platform/Library/Common/Utilities/Config.cs	
@@ -318,8 +318,7 @@ public static long GetRequestFilterSize(IApplicationStatusInfo appStatus)
 
             if (httpNode != null)
             {
-                var maxAllowedContentLength = XmlUtils.GetAttributeValueAsLong(httpNode.CreateNavigator(), "maxAllowedContentLength", 30000000);
-                return maxAllowedContentLength / 1024 / 1024;
+                return 4294967295 / 1024 / 1024; // 4GB (max allowedContentLength supported in IIS7)
             }
 
             return DefaultRequestFilter;
@@ -352,7 +351,6 @@ public static void SetMaxUploadSize(IApplicationStatusInfo appStatus, long newSi
             if (httpNode != null)
             {
                 httpNode.Attributes["maxRequestLength"].InnerText = (newSize / 1024).ToString("#");
-                httpNode.Attributes["requestLengthDiskThreshold"].InnerText = (newSize / 1024).ToString("#");
             }
 
             httpNode = configNav.SelectSingleNode("configuration//system.webServer//security//requestFiltering//requestLimits") ??
diff --git a/DNN Platform/Tests/App.config b/DNN Platform/Tests/App.config
index 95eedde44a2..3757a08e605 100644
--- a/DNN Platform/Tests/App.config	
+++ b/DNN Platform/Tests/App.config	
@@ -114,7 +114,7 @@
       <forms name=".DOTNETNUKE" protection="All" timeout="60" cookieless="UseCookies" />
     </authentication>
     <!-- allow large file uploads -->
-    <httpRuntime shutdownTimeout="120" executionTimeout="900" useFullyQualifiedRedirectUrl="true" maxRequestLength="12288" requestLengthDiskThreshold="12288" />
+    <httpRuntime shutdownTimeout="120" executionTimeout="900" useFullyQualifiedRedirectUrl="true" maxRequestLength="28672" requestLengthDiskThreshold="81920" />
     <httpCookies httpOnlyCookies="true" requireSSL="false" domain="" />
     <!--  GLOBALIZATION
     This section sets the globalization settings of the application. 
diff --git a/DNN Platform/Website/development.config b/DNN Platform/Website/development.config
index d4b7617df2f..6ab918f3fe6 100644
--- a/DNN Platform/Website/development.config	
+++ b/DNN Platform/Website/development.config	
@@ -117,6 +117,11 @@
         <add name="X-Frame-Options" value="SAMEORIGIN" />
       </customHeaders>
     </httpProtocol>
+    <security>
+      <requestFiltering>
+        <requestLimits maxAllowedContentLength="29360128" />
+      </requestFiltering>
+    </security>
   </system.webServer>
 
   <system.web>
@@ -149,7 +154,7 @@
     </authentication>
     -->
     <!-- allow large file uploads -->
-    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="29296" requestLengthDiskThreshold="81920" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false"  requestValidationMode="2.0" fcnMode="Single" />
+    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="28672" requestLengthDiskThreshold="81920" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false"  requestValidationMode="2.0" fcnMode="Single" />
     <httpCookies httpOnlyCookies="true" requireSSL="false" domain=""/>
     <!--  GLOBALIZATION
     This section sets the globalization settings of the application.
diff --git a/DNN Platform/Website/release.config b/DNN Platform/Website/release.config
index 22902c3a704..f8c8e9d6a34 100644
--- a/DNN Platform/Website/release.config	
+++ b/DNN Platform/Website/release.config	
@@ -117,6 +117,11 @@
         <add name="X-Frame-Options" value="SAMEORIGIN" />
       </customHeaders>
     </httpProtocol>
+    <security>
+      <requestFiltering>
+        <requestLimits maxAllowedContentLength="29360128" />
+      </requestFiltering>
+    </security>
   </system.webServer>
 
   <system.web>
@@ -150,7 +155,7 @@
     </authentication>
     -->
     <!-- allow large file uploads -->
-    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="29296" requestLengthDiskThreshold="81920" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false"  requestValidationMode="2.0" fcnMode="Single" />
+    <httpRuntime targetFramework="4.7.2" shutdownTimeout="120" executionTimeout="1200" useFullyQualifiedRedirectUrl="true" maxRequestLength="28672" requestLengthDiskThreshold="81920" maxUrlLength="2048" requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?" enableVersionHeader="false"  requestValidationMode="2.0" fcnMode="Single" />
     <httpCookies httpOnlyCookies="true" requireSSL="false" domain=""/>
     <!--  GLOBALIZATION
     This section sets the globalization settings of the application.
diff --git a/Dnn.AdminExperience/Dnn.PersonaBar.Extensions/Services/SecurityController.cs b/Dnn.AdminExperience/Dnn.PersonaBar.Extensions/Services/SecurityController.cs
index 55a264933df..2327110b166 100644
--- a/Dnn.AdminExperience/Dnn.PersonaBar.Extensions/Services/SecurityController.cs
+++ b/Dnn.AdminExperience/Dnn.PersonaBar.Extensions/Services/SecurityController.cs
@@ -709,7 +709,7 @@ public HttpResponseMessage GetOtherSettings()
                             Host.RememberCheckbox,
                             Host.AutoAccountUnlockDuration,
                             Host.AsyncTimeout,
-                            MaxUploadSize = Config.GetMaxUploadSize() / (1024 * 1024),
+                            MaxUploadSize = Config.GetMaxUploadSize() / 1024 / 1024,
                             RangeUploadSize = Config.GetRequestFilterSize(),
                             AllowedExtensionWhitelist = Host.AllowedExtensionWhitelist.ToStorageString(),
                             DefaultEndUserExtensionWhitelist = Host.DefaultEndUserExtensionWhitelist.ToStorageString(),