As are result of security penetration test the following changes applied:

All authentication related cookies tagged as httpOnly
web.config: enabledVersionHeader=false
autocomplete disabled
Login url injection redirection fixed
session hijacking implemented

Dont forget to apply ssl to your website with https and to set the requireSSL="false" to true

WebsitePanel/Sources/WebsitePanel.WebPortal/Code/PortalUtils.cs

@@ -268,6 +268,7 @@ namespace WebsitePanel.Portal
             authCookie.Secure = FormsAuthentication.RequireSSL;
             authCookie.Path = FormsAuthentication.FormsCookiePath;
             authCookie.Value = FormsAuthentication.Encrypt(ticket);
+            authCookie.HttpOnly = true;
 
             if (persistent)
                 authCookie.Expires = DateTime.Now.AddMonths(1);
@@ -500,6 +501,8 @@ namespace WebsitePanel.Portal
             // store last successful username in the cookie
             HttpCookie cookie = new HttpCookie("WebsitePanelLogin", username);
             cookie.Expires = DateTime.Now.AddDays(7);
+            cookie.Secure = FormsAuthentication.RequireSSL;
+            cookie.HttpOnly = true;
             HttpContext.Current.Response.Cookies.Add(cookie);
 
             // set language

WebsitePanel/Sources/WebsitePanel.WebPortal/Code/SecureSessionModule.cs

@@ -0,0 +1,153 @@
+using System;
+using System.Web;
+using System.Web.Security;
+using System.Web.Caching;
+using System.Configuration;
+using System.Security.Cryptography;
+using System.Runtime.Serialization;
+using System.Globalization;
+using System.Text;
+using Microsoft.Security.Application;
+
+namespace WebsitePanel.WebPortal
+{
+    public class SecureSessionModule : IHttpModule
+    {
+        public const string DEFAULT_PAGE = "~/Default.aspx";
+        public const string PAGE_ID_PARAM = "pid";
+
+        private static string _ValidationKey = null;
+
+        public void Init(HttpApplication app)
+        {
+            // Initialize validation key if not already initialized 
+            if (_ValidationKey == null)
+                _ValidationKey = GetValidationKey();
+
+            // Register handlers for BeginRequest and EndRequest events 
+            app.BeginRequest += new EventHandler(OnBeginRequest);
+            app.EndRequest += new EventHandler(OnEndRequest);
+        }
+
+        public void Dispose() { }
+
+        void OnBeginRequest(Object sender, EventArgs e)
+        {
+            // Look for an incoming cookie named "ASP.NET_SessionID" 
+            HttpRequest request = ((HttpApplication)sender).Request;
+            HttpCookie cookie = GetCookie(request, "ASP.NET_SessionId");
+
+            if (cookie != null)
+            {
+                // Throw an exception if the cookie lacks a MAC 
+                if (cookie.Value.Length <= 24)
+                {
+                    FormsAuthentication.SignOut();
+                    HttpContext.Current.Response.Redirect(DefaultPage.GetPageUrl(PortalConfiguration.SiteSettings["DefaultPage"]));
+                }
+
+                // Separate the session ID and the MAC 
+                string id = cookie.Value.Substring(0, 24);
+                string mac1 = cookie.Value.Substring(24);
+
+                // Generate a new MAC from the session ID and requestor info 
+                string mac2 = GetSessionIDMac(id, request.UserHostAddress,
+                    request.UserAgent, _ValidationKey);
+
+                // Throw an exception if the MACs don't match 
+                if (String.CompareOrdinal(mac1, mac2) != 0)
+                {
+                    FormsAuthentication.SignOut();
+                    HttpContext.Current.Response.Redirect(DefaultPage.GetPageUrl(PortalConfiguration.SiteSettings["DefaultPage"]));
+                }
+
+                // Strip the MAC from the cookie before ASP.NET sees it 
+                cookie.Value = id;
+            }
+        }
+
+        void OnEndRequest(Object sender, EventArgs e)
+        {
+            // Look for an outgoing cookie named "ASP.NET_SessionID" 
+            HttpRequest request = ((HttpApplication)sender).Request;
+            HttpCookie cookie = GetCookie( request, "ASP.NET_SessionId");
+
+            if (cookie != null)
+            {
+                // Add a MAC 
+                cookie.Value += GetSessionIDMac(cookie.Value,
+                    request.UserHostAddress, request.UserAgent,
+                    _ValidationKey);
+            }
+        }
+
+        private string GetValidationKey()
+        {
+            string key = ConfigurationManager.AppSettings["SessionValidationKey"];
+            if (key == null || key == String.Empty)
+                throw new InvalidSessionException
+                    ("SessionValidationKey missing");
+            return key;
+        }
+
+        private HttpCookie GetCookie(HttpRequest request, string name)
+        {
+            HttpCookieCollection cookies = request.Cookies;
+            return FindCookie(cookies, name);
+        }
+
+        private HttpCookie GetCookie(HttpResponse response, string name)
+        {
+            HttpCookieCollection cookies = response.Cookies;
+            return FindCookie(cookies, name);
+        }
+
+        private HttpCookie FindCookie(HttpCookieCollection cookies,
+            string name)
+        {
+            int count = cookies.Count;
+
+            for (int i = 0; i < count; i++)
+            {
+                if (String.Compare(cookies[i].Name, name, true,
+                    CultureInfo.InvariantCulture) == 0)
+                    return cookies[i];
+            }
+
+            return null;
+        }
+
+        private string GetSessionIDMac(string id, string ip,
+            string agent, string key)
+        {
+            StringBuilder builder = new StringBuilder(id, 512);
+            builder.Append(ip);
+            builder.Append(agent);
+
+            using (HMACSHA1 hmac = new HMACSHA1
+                (Encoding.UTF8.GetBytes(key)))
+            {
+                return Convert.ToBase64String(hmac.ComputeHash
+                   (Encoding.UTF8.GetBytes(builder.ToString())));
+            }
+        }
+    }
+
+    [Serializable]
+    public class InvalidSessionException : Exception
+    {
+        public InvalidSessionException() :
+            base("Session cookie is invalid") { }
+
+        public InvalidSessionException(string message) :
+            base(message) { }
+
+        public InvalidSessionException(string message,
+            Exception inner)
+            : base(message, inner) { }
+
+        protected InvalidSessionException(SerializationInfo info,
+            StreamingContext context)
+            : base(info, context) { }
+    }
+}

WebsitePanel/Sources/WebsitePanel.WebPortal/Default.aspx

@@ -13,7 +13,7 @@
 <![endif]--> 
 </head>
 <body>
-    <form id="form1" runat="server">
+    <form id="form1" runat="server"  autocomplete="off">
         <asp:PlaceHolder ID="skinPlaceHolder" runat="server"></asp:PlaceHolder>
     </form>
 </body>

WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/Ecommerce/WebsitePanel.Portal.Ecommerce.Modules.csproj

@@ -112,36 +112,42 @@
     </Compile>
     <Compile Include="BillingCycles.ascx.cs">
       <DependentUpon>BillingCycles.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="BillingCycles.ascx.designer.cs">
       <DependentUpon>BillingCycles.ascx</DependentUpon>
     </Compile>
     <Compile Include="BillingCyclesAddCycle.ascx.cs">
       <DependentUpon>BillingCyclesAddCycle.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="BillingCyclesAddCycle.ascx.designer.cs">
       <DependentUpon>BillingCyclesAddCycle.ascx</DependentUpon>
     </Compile>
     <Compile Include="BillingCyclesEditCycle.ascx.cs">
       <DependentUpon>BillingCyclesEditCycle.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="BillingCyclesEditCycle.ascx.designer.cs">
       <DependentUpon>BillingCyclesEditCycle.ascx</DependentUpon>
     </Compile>
     <Compile Include="Categories.ascx.cs">
       <DependentUpon>Categories.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="Categories.ascx.designer.cs">
       <DependentUpon>Categories.ascx</DependentUpon>
     </Compile>
     <Compile Include="CategoriesAddCategory.ascx.cs">
       <DependentUpon>CategoriesAddCategory.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CategoriesAddCategory.ascx.designer.cs">
       <DependentUpon>CategoriesAddCategory.ascx</DependentUpon>
     </Compile>
     <Compile Include="CategoriesEditCategory.ascx.cs">
       <DependentUpon>CategoriesEditCategory.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CategoriesEditCategory.ascx.designer.cs">
       <DependentUpon>CategoriesEditCategory.ascx</DependentUpon>
@@ -153,8 +159,12 @@
     <Compile Include="Code\Framework\CheckoutBasePage.cs">
       <SubType>ASPXCodeBehind</SubType>
     </Compile>
-    <Compile Include="Code\Framework\ecControlBase.cs" />
+    <Compile Include="Code\Framework\ecControlBase.cs">
-    <Compile Include="Code\Framework\ecModuleBase.cs" />
+      <SubType>ASPXCodeBehind</SubType>
+    </Compile>
+    <Compile Include="Code\Framework\ecModuleBase.cs">
+      <SubType>ASPXCodeBehind</SubType>
+    </Compile>
     <Compile Include="Code\Framework\ecPanelFormatter.cs" />
     <Compile Include="Code\Framework\ecPanelGlobals.cs" />
     <Compile Include="Code\Framework\ecPanelRequest.cs" />
@@ -181,150 +191,175 @@
     </Compile>
     <Compile Include="CustomerPaymentProfile.ascx.cs">
       <DependentUpon>CustomerPaymentProfile.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomerPaymentProfile.ascx.designer.cs">
       <DependentUpon>CustomerPaymentProfile.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersInvoices.ascx.cs">
       <DependentUpon>CustomersInvoices.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersInvoices.ascx.designer.cs">
       <DependentUpon>CustomersInvoices.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersInvoicesViewInvoice.ascx.cs">
       <DependentUpon>CustomersInvoicesViewInvoice.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersInvoicesViewInvoice.ascx.designer.cs">
       <DependentUpon>CustomersInvoicesViewInvoice.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersPayments.ascx.cs">
       <DependentUpon>CustomersPayments.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersPayments.ascx.designer.cs">
       <DependentUpon>CustomersPayments.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersServices.ascx.cs">
       <DependentUpon>CustomersServices.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersServices.ascx.designer.cs">
       <DependentUpon>CustomersServices.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersServicesUpgradeService.ascx.cs">
       <DependentUpon>CustomersServicesUpgradeService.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersServicesUpgradeService.ascx.designer.cs">
       <DependentUpon>CustomersServicesUpgradeService.ascx</DependentUpon>
     </Compile>
     <Compile Include="CustomersServicesViewService.ascx.cs">
       <DependentUpon>CustomersServicesViewService.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="CustomersServicesViewService.ascx.designer.cs">
       <DependentUpon>CustomersServicesViewService.ascx</DependentUpon>
     </Compile>
     <Compile Include="DomainNames.ascx.cs">
       <DependentUpon>DomainNames.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="DomainNames.ascx.designer.cs">
       <DependentUpon>DomainNames.ascx</DependentUpon>
     </Compile>
     <Compile Include="DomainNamesAddDomain.ascx.cs">
       <DependentUpon>DomainNamesAddDomain.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="DomainNamesAddDomain.ascx.designer.cs">
       <DependentUpon>DomainNamesAddDomain.ascx</DependentUpon>
     </Compile>
     <Compile Include="DomainNamesEditDomain.ascx.cs">
       <DependentUpon>DomainNamesEditDomain.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="DomainNamesEditDomain.ascx.designer.cs">
       <DependentUpon>DomainNamesEditDomain.ascx</DependentUpon>
     </Compile>
     <Compile Include="DomainRegistrarDirecti.ascx.cs">
       <DependentUpon>DomainRegistrarDirecti.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="DomainRegistrarDirecti.ascx.designer.cs">
       <DependentUpon>DomainRegistrarDirecti.ascx</DependentUpon>
     </Compile>
     <Compile Include="DomainRegistrarEnom.ascx.cs">
       <DependentUpon>DomainRegistrarEnom.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="DomainRegistrarEnom.ascx.designer.cs">
       <DependentUpon>DomainRegistrarEnom.ascx</DependentUpon>
     </Compile>
     <Compile Include="EcommerceSystemSettings.ascx.cs">
       <DependentUpon>EcommerceSystemSettings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="EcommerceSystemSettings.ascx.designer.cs">
       <DependentUpon>EcommerceSystemSettings.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingAddons.ascx.cs">
       <DependentUpon>HostingAddons.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingAddons.ascx.designer.cs">
       <DependentUpon>HostingAddons.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingAddonsAddAddon.ascx.cs">
       <DependentUpon>HostingAddonsAddAddon.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingAddonsAddAddon.ascx.designer.cs">
       <DependentUpon>HostingAddonsAddAddon.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingAddonsEditAddon.ascx.cs">
       <DependentUpon>HostingAddonsEditAddon.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingAddonsEditAddon.ascx.designer.cs">
       <DependentUpon>HostingAddonsEditAddon.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingPlans.ascx.cs">
       <DependentUpon>HostingPlans.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingPlans.ascx.designer.cs">
       <DependentUpon>HostingPlans.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingPlansAddPlan.ascx.cs">
       <DependentUpon>HostingPlansAddPlan.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingPlansAddPlan.ascx.designer.cs">
       <DependentUpon>HostingPlansAddPlan.ascx</DependentUpon>
     </Compile>
     <Compile Include="HostingPlansEditPlan.ascx.cs">
       <DependentUpon>HostingPlansEditPlan.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="HostingPlansEditPlan.ascx.designer.cs">
       <DependentUpon>HostingPlansEditPlan.ascx</DependentUpon>
     </Compile>
     <Compile Include="NotificationNewInvoice.ascx.cs">
       <DependentUpon>NotificationNewInvoice.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="NotificationNewInvoice.ascx.designer.cs">
       <DependentUpon>NotificationNewInvoice.ascx</DependentUpon>
     </Compile>
     <Compile Include="NotificationPaymentReceived.ascx.cs">
       <DependentUpon>NotificationPaymentReceived.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="NotificationPaymentReceived.ascx.designer.cs">
       <DependentUpon>NotificationPaymentReceived.ascx</DependentUpon>
     </Compile>
     <Compile Include="NotificationServiceActivated.ascx.cs">
       <DependentUpon>NotificationServiceActivated.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="NotificationServiceActivated.ascx.designer.cs">
       <DependentUpon>NotificationServiceActivated.ascx</DependentUpon>
     </Compile>
     <Compile Include="NotificationServiceCancelled.ascx.cs">
       <DependentUpon>NotificationServiceCancelled.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="NotificationServiceCancelled.ascx.designer.cs">
       <DependentUpon>NotificationServiceCancelled.ascx</DependentUpon>
     </Compile>
     <Compile Include="NotificationServiceSuspended.ascx.cs">
       <DependentUpon>NotificationServiceSuspended.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="NotificationServiceSuspended.ascx.designer.cs">
       <DependentUpon>NotificationServiceSuspended.ascx</DependentUpon>
     </Compile>
     <Compile Include="OrderFailed.ascx.cs">
       <DependentUpon>OrderFailed.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="OrderFailed.ascx.designer.cs">
       <DependentUpon>OrderFailed.ascx</DependentUpon>
@@ -338,48 +373,56 @@
     </Compile>
     <Compile Include="PaymentMethod2Checkout.ascx.cs">
       <DependentUpon>PaymentMethod2Checkout.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethod2Checkout.ascx.designer.cs">
       <DependentUpon>PaymentMethod2Checkout.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethodCreditCard.ascx.cs">
       <DependentUpon>PaymentMethodCreditCard.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethodCreditCard.ascx.designer.cs">
       <DependentUpon>PaymentMethodCreditCard.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethodOffline.ascx.cs">
       <DependentUpon>PaymentMethodOffline.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethodOffline.ascx.designer.cs">
       <DependentUpon>PaymentMethodOffline.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethodPayPalAccount.ascx.cs">
       <DependentUpon>PaymentMethodPayPalAccount.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethodPayPalAccount.ascx.designer.cs">
       <DependentUpon>PaymentMethodPayPalAccount.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethods\2CO_Payment.ascx.cs">
       <DependentUpon>2CO_Payment.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethods\2CO_Payment.ascx.designer.cs">
       <DependentUpon>2CO_Payment.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethods\CreditCard_Payment.ascx.cs">
       <DependentUpon>CreditCard_Payment.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethods\CreditCard_Payment.ascx.designer.cs">
       <DependentUpon>CreditCard_Payment.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethods\Offline_Payment.ascx.cs">
       <DependentUpon>Offline_Payment.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethods\Offline_Payment.ascx.designer.cs">
       <DependentUpon>Offline_Payment.ascx</DependentUpon>
     </Compile>
     <Compile Include="PaymentMethods\PPAccount_Payment.ascx.cs">
       <DependentUpon>PPAccount_Payment.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="PaymentMethods\PPAccount_Payment.ascx.designer.cs">
       <DependentUpon>PPAccount_Payment.ascx</DependentUpon>
@@ -393,30 +436,35 @@
     </Compile>
     <Compile Include="ProductControls\DomainName_ServiceDetails.ascx.cs">
       <DependentUpon>DomainName_ServiceDetails.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProductControls\DomainName_ServiceDetails.ascx.designer.cs">
       <DependentUpon>DomainName_ServiceDetails.ascx</DependentUpon>
     </Compile>
     <Compile Include="ProductControls\HostingAddon_ServiceDetails.ascx.cs">
       <DependentUpon>HostingAddon_ServiceDetails.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProductControls\HostingAddon_ServiceDetails.ascx.designer.cs">
       <DependentUpon>HostingAddon_ServiceDetails.ascx</DependentUpon>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_Brief.ascx.cs">
       <DependentUpon>HostingPlan_Brief.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_Brief.ascx.designer.cs">
       <DependentUpon>HostingPlan_Brief.ascx</DependentUpon>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_Highlights.ascx.cs">
       <DependentUpon>HostingPlan_Highlights.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_Highlights.ascx.designer.cs">
       <DependentUpon>HostingPlan_Highlights.ascx</DependentUpon>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_ServiceDetails.ascx.cs">
       <DependentUpon>HostingPlan_ServiceDetails.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProductControls\HostingPlan_ServiceDetails.ascx.designer.cs">
       <DependentUpon>HostingPlan_ServiceDetails.ascx</DependentUpon>
@@ -424,24 +472,28 @@
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="ProvisioningSettingsEdit.ascx.cs">
       <DependentUpon>ProvisioningSettingsEdit.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ProvisioningSettingsEdit.ascx.designer.cs">
       <DependentUpon>ProvisioningSettingsEdit.ascx</DependentUpon>
     </Compile>
     <Compile Include="QuickSignup.ascx.cs">
       <DependentUpon>QuickSignup.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="QuickSignup.ascx.designer.cs">
       <DependentUpon>QuickSignup.ascx</DependentUpon>
     </Compile>
     <Compile Include="OrderComplete.ascx.cs">
       <DependentUpon>OrderComplete.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="OrderComplete.ascx.designer.cs">
       <DependentUpon>OrderComplete.ascx</DependentUpon>
     </Compile>
     <Compile Include="OrderCheckout.ascx.cs">
       <DependentUpon>OrderCheckout.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="OrderCheckout.ascx.designer.cs">
       <DependentUpon>OrderCheckout.ascx</DependentUpon>
@@ -453,102 +505,119 @@
     </Compile>
     <Compile Include="SkinControls\CatalogBreadCrumb.ascx.cs">
       <DependentUpon>CatalogBreadCrumb.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SkinControls\CatalogBreadCrumb.ascx.designer.cs">
       <DependentUpon>CatalogBreadCrumb.ascx</DependentUpon>
     </Compile>
     <Compile Include="StorefrontMenu.ascx.cs">
       <DependentUpon>StorefrontMenu.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="StorefrontMenu.ascx.designer.cs">
       <DependentUpon>StorefrontMenu.ascx</DependentUpon>
     </Compile>
     <Compile Include="StorefrontOrderProduct.ascx.cs">
       <DependentUpon>StorefrontOrderProduct.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="StorefrontOrderProduct.ascx.designer.cs">
       <DependentUpon>StorefrontOrderProduct.ascx</DependentUpon>
     </Compile>
     <Compile Include="StorefrontViewCategory.ascx.cs">
       <DependentUpon>StorefrontViewCategory.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="StorefrontViewCategory.ascx.designer.cs">
       <DependentUpon>StorefrontViewCategory.ascx</DependentUpon>
     </Compile>
     <Compile Include="StorefrontWelcome.ascx.cs">
       <DependentUpon>StorefrontWelcome.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="StorefrontWelcome.ascx.designer.cs">
       <DependentUpon>StorefrontWelcome.ascx</DependentUpon>
     </Compile>
     <Compile Include="StorefrontWelcomeEdit.ascx.cs">
       <DependentUpon>StorefrontWelcomeEdit.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="StorefrontWelcomeEdit.ascx.designer.cs">
       <DependentUpon>StorefrontWelcomeEdit.ascx</DependentUpon>
     </Compile>
     <Compile Include="SupportedPlugins\2Checkout_Settings.ascx.cs">
       <DependentUpon>2Checkout_Settings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SupportedPlugins\2Checkout_Settings.ascx.designer.cs">
       <DependentUpon>2Checkout_Settings.ascx</DependentUpon>
     </Compile>
     <Compile Include="SupportedPlugins\AuthorizeNet_Settings.ascx.cs">
       <DependentUpon>AuthorizeNet_Settings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SupportedPlugins\AuthorizeNet_Settings.ascx.designer.cs">
       <DependentUpon>AuthorizeNet_Settings.ascx</DependentUpon>
     </Compile>
     <Compile Include="SupportedPlugins\OfflinePayment_Settings.ascx.cs">
       <DependentUpon>OfflinePayment_Settings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SupportedPlugins\OfflinePayment_Settings.ascx.designer.cs">
       <DependentUpon>OfflinePayment_Settings.ascx</DependentUpon>
     </Compile>
     <Compile Include="SupportedPlugins\PayPalPro_Settings.ascx.cs">
       <DependentUpon>PayPalPro_Settings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SupportedPlugins\PayPalPro_Settings.ascx.designer.cs">
       <DependentUpon>PayPalPro_Settings.ascx</DependentUpon>
     </Compile>
     <Compile Include="SupportedPlugins\PayPalStandard_Settings.ascx.cs">
       <DependentUpon>PayPalStandard_Settings.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="SupportedPlugins\PayPalStandard_Settings.ascx.designer.cs">
       <DependentUpon>PayPalStandard_Settings.ascx</DependentUpon>
     </Compile>
     <Compile Include="Taxations.ascx.cs">
       <DependentUpon>Taxations.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="Taxations.ascx.designer.cs">
       <DependentUpon>Taxations.ascx</DependentUpon>
     </Compile>
     <Compile Include="TaxationsAddTax.ascx.cs">
       <DependentUpon>TaxationsAddTax.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="TaxationsAddTax.ascx.designer.cs">
       <DependentUpon>TaxationsAddTax.ascx</DependentUpon>
     </Compile>
     <Compile Include="TaxationsEditTax.ascx.cs">
       <DependentUpon>TaxationsEditTax.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="TaxationsEditTax.ascx.designer.cs">
       <DependentUpon>TaxationsEditTax.ascx</DependentUpon>
     </Compile>
     <Compile Include="TermsAndConditions.ascx.cs">
       <DependentUpon>TermsAndConditions.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="TermsAndConditions.ascx.designer.cs">
       <DependentUpon>TermsAndConditions.ascx</DependentUpon>
     </Compile>
     <Compile Include="TermsAndConditionsEdit.ascx.cs">
       <DependentUpon>TermsAndConditionsEdit.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="TermsAndConditionsEdit.ascx.designer.cs">
       <DependentUpon>TermsAndConditionsEdit.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\AddonProducts.ascx.cs">
       <DependentUpon>AddonProducts.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\AddonProducts.ascx.designer.cs">
       <DependentUpon>AddonProducts.ascx</DependentUpon>
@@ -565,120 +634,140 @@
     </Compile>
     <Compile Include="UserControls\ChoosePaymentMethod.ascx.cs">
       <DependentUpon>ChoosePaymentMethod.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\ChoosePaymentMethod.ascx.designer.cs">
       <DependentUpon>ChoosePaymentMethod.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\CreateUserAccount.ascx.cs">
       <DependentUpon>CreateUserAccount.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\CreateUserAccount.ascx.designer.cs">
       <DependentUpon>CreateUserAccount.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\CustomerInvoiceTemplated.ascx.cs">
       <DependentUpon>CustomerInvoiceTemplated.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\CustomerInvoiceTemplated.ascx.designer.cs">
       <DependentUpon>CustomerInvoiceTemplated.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\DomainNameBillingCycles.ascx.cs">
       <DependentUpon>DomainNameBillingCycles.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\DomainNameBillingCycles.ascx.designer.cs">
       <DependentUpon>DomainNameBillingCycles.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\EmailNotificationEditor.ascx.cs">
       <DependentUpon>EmailNotificationEditor.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\EmailNotificationEditor.ascx.designer.cs">
       <DependentUpon>EmailNotificationEditor.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\HostingAddonOneTimeFee.ascx.cs">
       <DependentUpon>HostingAddonOneTimeFee.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\HostingAddonOneTimeFee.ascx.designer.cs">
       <DependentUpon>HostingAddonOneTimeFee.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\HostingPlanBillingCycles.ascx.cs">
       <DependentUpon>HostingPlanBillingCycles.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\HostingPlanBillingCycles.ascx.designer.cs">
       <DependentUpon>HostingPlanBillingCycles.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\HostingPlanQuotas.ascx.cs">
       <DependentUpon>HostingPlanQuotas.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\HostingPlanQuotas.ascx.designer.cs">
       <DependentUpon>HostingPlanQuotas.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\LoginUserAccount.ascx.cs">
       <DependentUpon>LoginUserAccount.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\LoginUserAccount.ascx.designer.cs">
       <DependentUpon>LoginUserAccount.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\ManualPaymentAdd.ascx.cs">
       <DependentUpon>ManualPaymentAdd.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\ManualPaymentAdd.ascx.designer.cs">
       <DependentUpon>ManualPaymentAdd.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\PlanDomainOption.ascx.cs">
       <DependentUpon>PlanDomainOption.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\PlanDomainOption.ascx.designer.cs">
       <DependentUpon>PlanDomainOption.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\PlanHostingAddons.ascx.cs">
       <DependentUpon>PlanHostingAddons.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\PlanHostingAddons.ascx.designer.cs">
       <DependentUpon>PlanHostingAddons.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\ProductHighlights.ascx.cs">
       <DependentUpon>ProductHighlights.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\ProductHighlights.ascx.designer.cs">
       <DependentUpon>ProductHighlights.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\QuickHostingAddon.ascx.cs">
       <DependentUpon>QuickHostingAddon.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\QuickHostingAddon.ascx.designer.cs">
       <DependentUpon>QuickHostingAddon.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\QuickHostingPlanCycles.ascx.cs">
       <DependentUpon>QuickHostingPlanCycles.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\QuickHostingPlanCycles.ascx.designer.cs">
       <DependentUpon>QuickHostingPlanCycles.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\QuickHostingPlans.ascx.cs">
       <DependentUpon>QuickHostingPlans.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\QuickHostingPlans.ascx.designer.cs">
       <DependentUpon>QuickHostingPlans.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\PathBreadCrumb.ascx.cs">
       <DependentUpon>PathBreadCrumb.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\PathBreadCrumb.ascx.designer.cs">
       <DependentUpon>PathBreadCrumb.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\ProductCategories.ascx.cs">
       <DependentUpon>ProductCategories.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\ProductCategories.ascx.designer.cs">
       <DependentUpon>ProductCategories.ascx</DependentUpon>
     </Compile>
     <Compile Include="UserControls\UserAccountDetails.ascx.cs">
       <DependentUpon>UserAccountDetails.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="UserControls\UserAccountDetails.ascx.designer.cs">
       <DependentUpon>UserAccountDetails.ascx</DependentUpon>
     </Compile>
     <Compile Include="ViewProductDetails.ascx.cs">
       <DependentUpon>ViewProductDetails.ascx</DependentUpon>
+      <SubType>ASPXCodeBehind</SubType>
     </Compile>
     <Compile Include="ViewProductDetails.ascx.designer.cs">
       <DependentUpon>ViewProductDetails.ascx</DependentUpon>

WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/Code/Framework/PanelSecurity.cs

@@ -130,6 +130,7 @@ namespace WebsitePanel.Portal
             HttpContext.Current.Items[key] = s;
 
             HttpCookie cookie = new HttpCookie(key, s);
+            cookie.HttpOnly = true;
             HttpContext.Current.Response.Cookies.Remove(key);
             HttpContext.Current.Response.Cookies.Add(cookie);
         }

WebsitePanel/Sources/WebsitePanel.WebPortal/DesktopModules/WebsitePanel/Login.ascx.cs

@@ -1,4 +1,4 @@
-// Copyright (c) 2012, Outercurve Foundation.
+// Copyright (c) 2011, Outercurve Foundation.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -33,129 +33,154 @@ using WebsitePanel.EnterpriseServer;
 
 namespace WebsitePanel.Portal
 {
-	public partial class Login : WebsitePanelModuleBase
+    public partial class Login : WebsitePanelModuleBase
-	{
+    {
-		string ipAddress;
+        string ipAddress;
 
-		private string RedirectUrl
+        private bool IsLocalUrl(string url)
-		{
+        {
-			get
+            if (string.IsNullOrEmpty(url))
-			{
+            {
-				string redirectUrl = "";
+                return false;
-				if (Request["returnurl"] != null)
+            }
-				{
-					// return to the url passed to signin
-					redirectUrl = HttpUtility.UrlDecode(Request["returnurl"]);
-				}
-				else
-				{
-					redirectUrl = PortalUtils.LoginRedirectUrl;
-				}
-				return redirectUrl;
-			}
-		}
 
-		protected void Page_Load(object sender, EventArgs e)
+            Uri absoluteUri;
-		{
+            if (Uri.TryCreate(url, UriKind.Absolute, out absoluteUri))
-			if (!IsPostBack)
+            {
-			{
+                return String.Equals(this.Request.Url.Host, absoluteUri.Host, StringComparison.OrdinalIgnoreCase);
-				EnsureSCPA();
+            }
-				//
+            else
-				BindControls();
+            {
-			}
+                bool isLocal = !url.StartsWith("http:", StringComparison.OrdinalIgnoreCase)
+                    && !url.StartsWith("https:", StringComparison.OrdinalIgnoreCase)
+                    && Uri.IsWellFormedUriString(url, UriKind.Relative);
+                return isLocal;
+            }
+        }
 
-			// capture Enter key
+        private string RedirectUrl
-			//DotNetNuke.UI.Utilities.ClientAPI.RegisterKeyCapture(this.Parent, btnLogin, 13);
+        {
+            get
+            {
+                string redirectUrl = "";
+                if (Request["returnurl"] != null)
+                {
+                    // return to the url passed to signin
+                    redirectUrl = HttpUtility.UrlDecode(Request["returnurl"]);
+                    if (!IsLocalUrl(redirectUrl))
+                    {
+                        redirectUrl = PortalUtils.LoginRedirectUrl;
+                    }
+                }
+                else
+                {
+                    redirectUrl = PortalUtils.LoginRedirectUrl;
+                }
+                return redirectUrl;
+            }
+        }
 
-			// get user IP
+        protected void Page_Load(object sender, EventArgs e)
-			if (Request.UserHostAddress != null)
+        {
-				ipAddress = Request.UserHostAddress;
+            if (!IsPostBack)
+            {
+                EnsureSCPA();
+                //
+                BindControls();
+            }
 
-			// update password control
+            // capture Enter key
-			txtPassword.Attributes["value"] = txtPassword.Text;
+            //DotNetNuke.UI.Utilities.ClientAPI.RegisterKeyCapture(this.Parent, btnLogin, 13);
 
-			// autologin
+            // get user IP
-			string usr = Request["u"];
+            if (Request.UserHostAddress != null)
-			if (String.IsNullOrEmpty(usr))
+                ipAddress = Request.UserHostAddress;
-				usr = Request["user"];
 
-			string psw = Request["p"];
+            // update password control
-			if (String.IsNullOrEmpty(psw))
+            txtPassword.Attributes["value"] = txtPassword.Text;
-				psw = Request["pwd"];
-			if (String.IsNullOrEmpty(psw))
-				psw = Request["password"];
 
-			if (!String.IsNullOrEmpty(usr) && !String.IsNullOrEmpty(psw))
+            // autologin
-			{
+            string usr = Request["u"];
-				// perform login
+            if (String.IsNullOrEmpty(usr))
-				LoginUser(usr, psw, chkRemember.Checked, String.Empty, String.Empty);
+                usr = Request["user"];
-			}
-		}
 
-		private void EnsureSCPA()
+            string psw = Request["p"];
-		{
+            if (String.IsNullOrEmpty(psw))
-			var enabledScpa = ES.Services.Authentication.GetSystemSetupMode();
+                psw = Request["pwd"];
-			//
+            if (String.IsNullOrEmpty(psw))
-			if (enabledScpa == false)
+                psw = Request["password"];
-			{
-				return;
-			}
-			//
-			Response.Redirect(EditUrl("scpa"), true);
-		}
 
-		private void BindControls()
+            if (!String.IsNullOrEmpty(usr) && !String.IsNullOrEmpty(psw))
-		{
+            {
-			// load languages
+                // perform login
-			PortalUtils.LoadCultureDropDownList(ddlLanguage);            
+                LoginUser(usr, psw, chkRemember.Checked, String.Empty, String.Empty);
+            }
+        }
 
-			// load themes
+        private void EnsureSCPA()
-			PortalUtils.LoadThemesDropDownList(ddlTheme);
+        {
+            var enabledScpa = ES.Services.Authentication.GetSystemSetupMode();
+            //
+            if (enabledScpa == false)
+            {
+                return;
+            }
+            //
+            Response.Redirect(EditUrl("scpa"), true);
+        }
 
-			// try to get the last login name from cookie
+        private void BindControls()
-			HttpCookie cookie = Request.Cookies["WebsitePanelLogin"];
+        {
-			if (cookie != null)
+            // load languages
-			{
+            PortalUtils.LoadCultureDropDownList(ddlLanguage);
-				txtUsername.Text = cookie.Value;
-			}
-		}
 
-		protected void cmdForgotPassword_Click(object sender, EventArgs e)
+            // load themes
-		{
+            PortalUtils.LoadThemesDropDownList(ddlTheme);
-			Response.Redirect(EditUrl("forgot_password"), true);
-		}
 
-		protected void btnLogin_Click(object sender, EventArgs e)
+            // try to get the last login name from cookie
-		{
+            HttpCookie cookie = Request.Cookies["WebsitePanelLogin"];
-			// validate input
+            if (cookie != null)
-			if (!Page.IsValid)
+            {
-				return;
+                txtUsername.Text = cookie.Value;
+            }
+        }
 
-			// perform login
+        protected void cmdForgotPassword_Click(object sender, EventArgs e)
-			LoginUser(txtUsername.Text.Trim(), txtPassword.Text, chkRemember.Checked,
+        {
-				ddlLanguage.SelectedValue, ddlTheme.SelectedValue);
+            Response.Redirect(EditUrl("forgot_password"), true);
-		}
+        }
 
-		private void LoginUser(string username, string password, bool rememberLogin,
+        protected void btnLogin_Click(object sender, EventArgs e)
-			string preferredLocale, string theme)
+        {
-		{
+            // validate input
-			// status
+            if (!Page.IsValid)
-			int loginStatus = PortalUtils.AuthenticateUser(username, password, ipAddress,
+                return;
-				rememberLogin, preferredLocale, theme);
 
-			if (loginStatus < 0)
+            // perform login
-			{
+            LoginUser(txtUsername.Text.Trim(), txtPassword.Text, chkRemember.Checked,
+                ddlLanguage.SelectedValue, ddlTheme.SelectedValue);
+        }
+
+        private void LoginUser(string username, string password, bool rememberLogin,
+            string preferredLocale, string theme)
+        {
+            // status
+            int loginStatus = PortalUtils.AuthenticateUser(username, password, ipAddress,
+                rememberLogin, preferredLocale, theme);
+
+            if (loginStatus < 0)
+            {
                 ShowWarningMessage("WrongLogin");
-			}
+            }
-			else
+            else
-			{
+            {
                 // redirect by shortcut
                 ShortcutRedirect();
 
                 // standard redirect
-				Response.Redirect(RedirectUrl, true);
+                Response.Redirect(RedirectUrl, true);
-			}
+            }
-		}
+        }
 
         private void ShortcutRedirect()
         {
@@ -223,22 +248,22 @@ namespace WebsitePanel.Portal
             }
         }
 
-		private void SetCurrentLanguage()
+        private void SetCurrentLanguage()
-		{
+        {
             PortalUtils.SetCurrentLanguage(ddlLanguage.SelectedValue);
             Response.Redirect(Request.Url.ToString());
-		    
+
-		}
-        
-        protected void ddlLanguage_SelectedIndexChanged(object sender, EventArgs e)
-		{
-		    SetCurrentLanguage();
         }
 
-		protected void ddlTheme_SelectedIndexChanged(object sender, EventArgs e)
+        protected void ddlLanguage_SelectedIndexChanged(object sender, EventArgs e)
-		{
+        {
-			PortalUtils.SetCurrentTheme(ddlTheme.SelectedValue);
+            SetCurrentLanguage();
-			Response.Redirect(Request.Url.ToString());
+        }
-		}
+
-	}
+        protected void ddlTheme_SelectedIndexChanged(object sender, EventArgs e)
+        {
+            PortalUtils.SetCurrentTheme(ddlTheme.SelectedValue);
+            Response.Redirect(Request.Url.ToString());
+        }
+    }
 }

WebsitePanel/Sources/WebsitePanel.WebPortal/Web.config

@@ -4,6 +4,7 @@
 		<add key="WebPortal.ThemeProvider" value="WebsitePanel.Portal.WebPortalThemeProvider, WebsitePanel.Portal.Modules"/>
 		<add key="WebPortal.PageTitleProvider" value="WebsitePanel.Portal.WebPortalPageTitleProvider, WebsitePanel.Portal.Modules"/>
 		<add key="ChartImageHandler" value="storage=file;timeout=20;" />
+    <add key="SessionValidationKey" value="DAD46D476F85E0198BCA134D7AA5CC1D7" />
 	</appSettings>
 	<system.web>
 		<!-- SiteMap settings -->
@@ -19,7 +20,7 @@
 			</controls>
 		</pages>
 		<!-- Maximum size of uploaded file, in MB -->
-		<httpRuntime executionTimeout="1800" requestValidationMode="2.0" maxRequestLength="16384"/>
+		<httpRuntime executionTimeout="1800" requestValidationMode="2.0" maxRequestLength="16384" enableVersionHeader="false"/>
 		<!--
           ASMX is mapped to a new handler so that proxy javascripts can also be served.
     -->
@@ -47,5 +48,8 @@
 		<handlers>
 			<add name="ChartImg" path="ChartImg.axd" verb="GET,HEAD,POST" type="System.Web.UI.DataVisualization.Charting.ChartHttpHandler, System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" resourceType="Unspecified" preCondition="integratedMode" />
 		</handlers>
-	</system.webServer>
+    <modules>
+      <add name="SecureSession" type="WebsitePanel.WebPortal.SecureSessionModule" />
+    </modules>
+  </system.webServer>
 </configuration>

WebsitePanel/Sources/WebsitePanel.WebPortal/WebsitePanel.WebPortal.csproj

@@ -157,6 +157,7 @@
     <Compile Include="Code\ContentPane.cs" />
     <Compile Include="Code\Controls\DesktopContextValidator.cs" />
     <Compile Include="Code\PortalUtils.cs" />
+    <Compile Include="Code\SecureSessionModule.cs" />
     <Compile Include="Code\WebPortalControlBase.cs">
       <SubType>ASPXCodeBehind</SubType>
     </Compile>