<commit_before>﻿@using WebMatrix.WebData;
@using WebMatrix.Security;
@using System.Web.Routing;
@using System.Configuration;
@{
    WebSecurity.InitializeDatabaseConnection("sqlloco", "userprofile", "UserId", "Email", false);

    // To let users of this site log in using their accounts from other sites such as Facebook, Twitter, 
    // and Windows Live, you must update this site. For more information visit 
    // http://go.microsoft.com/fwlink/?LinkID=226949
    //OAuthWebSecurity.RegisterOpenIDClient(BuiltInOpenIDClient.Google);
    //OAuthWebSecurity.RegisterOpenIDClient(BuiltInOpenIDClient.Yahoo);
    /*OAuthWebSecurity.RegisterOAuthClient( 
        BuiltInOAuthClient.Facebook, 
        consumerKey: "a",   // for Facebook, consumerKey is called AppID in the SDK 
        consumerSecret: "b");*/


    // Facebook connection options to the Developer App Version 'Loconomics', SiteUrl: http://loconomics.com/
    // Facebook App Link: https://developers.facebook.com/apps/180579422039773
    var facebookAppId = ConfigurationManager.AppSettings["facebookAppId"];
    var facebookAppSecret = ConfigurationManager.AppSettings["facebookAppSecret"];
    Facebook.Initialize(facebookAppId, facebookAppSecret, "sqlloco");

    /* Routing rules
    */
    // REST API, locale in URL for locale independent files:
    // NOTE: Any folder added to the API folder need to be registered, and before the catch-all pages route
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/me/{page}/{*urldata}", "~/api/v1/me/{page}.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/users/{userID}", "~/api/v1/users/index.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/users/{userID}/{page}/{*urldata}", "~/api/v1/users/{page}.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/auth/{page}/{*urldata}", "~/api/v1/auth/{page}.cshtml");
    // DEPRECATED: Auth alias for previously used REST URLs (originally in the root of the REST URL)
    // TODO This URLs are deprecated, so at some point next 4 alias must be removed
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/facebook-user", "~/api/v1/auth/facebook-user.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/login/{*urldata}", "~/api/v1/auth/login.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/logout", "~/api/v1/auth/logout.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/signup/{*urldata}", "~/api/v1/auth/signup.cshtml");
    // Disabled experimental icalendar route
    //RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/icalendar/{page}", "~/api/v1/icalendar/{page}.cshtml");
    // Catch-all pages route, will route to any page inmediately in the API folder, or Not Found
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/{page}/{*urldata}", "~/api/v1/{page}.cshtml");

    // ScheduledTask
    RouteTable.Routes.MapWebPageRoute("scheduledtask", "~/_specialRoutes/ScheduledTask.cshtml");
    // PaymentGatewayWebhook: hook URL to allow Braintree to contact us about transactions/merchant account information
    RouteTable.Routes.MapWebPageRoute("PaymentGatewayWebhook", "~/_specialRoutes/PaymentGatewayWebhook.cshtml");
    // iCalendar URL
    RouteTable.Routes.MapWebPageRoute("calendar/{userID}/{token}/{file}", "~/_specialRoutes/Calendar.cshtml");

    // Public User profile photo, KEEPING URL AS IN Release-6.3 FOR RELEASE-7+
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo", "~/_specialRoutes/UserProfilePhoto.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo/{userID}", "~/_specialRoutes/UserProfilePhoto.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo/{userID}/{type}", "~/_specialRoutes/UserProfilePhoto.cshtml");    
    
    // Auth
    RouteTable.Routes.MapWebPageRoute("{locale}/auth/login", "~/_specialRoutes/Login.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/auth/confirm", "~/_specialRoutes/Confirm.cshtml");
    RouteTable.Routes.MapWebPageRoute("auth/login", "~/_specialRoutes/Login.cshtml");
    RouteTable.Routes.MapWebPageRoute("auth/confirm", "~/_specialRoutes/Confirm.cshtml");
    
    // App/Webapp explicit rules
    // TODO: some day this list needs to be automatic, from the activity list, right now has some explicit rules to avoid conflicts with
    // more generic rules after this (the problematic is the customURL rule, basically)
    RouteTable.Routes.MapWebPageRoute("login/{*urldata}", "~/Default.cshtml");

    // Special Server ROUTES
    // Booking with service professional bookcode URL
    RouteTable.Routes.MapWebPageRoute("book/{bookcode}", "~/_specialRoutes/Book.cshtml");
    RouteTable.Routes.MapWebPageRoute("book/{bookcode}/{jobTitleID}", "~/_specialRoutes/Book.cshtml");
    // Public Profile URL optimized for SEO:
    RouteTable.Routes.MapWebPageRoute("{city}/{jobTitle}/{user}", "~/_specialRoutes/PublicProfileURL.cshtml");
    // CustomURL:
    RouteTable.Routes.MapWebPageRoute(LcRest.MarketplaceProfile.CustomUrlPrefix + "{customurl}/", "~/_specialRoutes/CustomURL.cshtml");
    // Refer professionals
    RouteTable.Routes.MapWebPageRoute("refer/", "~/_specialRoutes/refer.cshtml");

    // MANAGE SPA ROUTES REDIRECTING TO INDEX
    // CATCH-ALL:
    RouteTable.Routes.MapWebPageRoute("{*any}", "~/Default.cshtml");

    // IMPORTANT: because of the previous CATCH-ALL, this will never being displayed.
    // BUT is important to know how to do it, since is expected we can replace the catch-all by specific SPA page URLs
    // ANY NOT FOUND URL
    RouteTable.Routes.MapWebPageRoute("{*urldata}", "~/Errors/Error404.cshtml");
}<commit_msg>Fixed false positive isse at PCI scan related to webcart URLs #1196<commit_after>﻿@using WebMatrix.WebData;
@using WebMatrix.Security;
@using System.Web.Routing;
@using System.Configuration;
@{
    WebSecurity.InitializeDatabaseConnection("sqlloco", "userprofile", "UserId", "Email", false);

    // To let users of this site log in using their accounts from other sites such as Facebook, Twitter, 
    // and Windows Live, you must update this site. For more information visit 
    // http://go.microsoft.com/fwlink/?LinkID=226949
    //OAuthWebSecurity.RegisterOpenIDClient(BuiltInOpenIDClient.Google);
    //OAuthWebSecurity.RegisterOpenIDClient(BuiltInOpenIDClient.Yahoo);
    /*OAuthWebSecurity.RegisterOAuthClient( 
        BuiltInOAuthClient.Facebook, 
        consumerKey: "a",   // for Facebook, consumerKey is called AppID in the SDK 
        consumerSecret: "b");*/


    // Facebook connection options to the Developer App Version 'Loconomics', SiteUrl: http://loconomics.com/
    // Facebook App Link: https://developers.facebook.com/apps/180579422039773
    var facebookAppId = ConfigurationManager.AppSettings["facebookAppId"];
    var facebookAppSecret = ConfigurationManager.AppSettings["facebookAppSecret"];
    Facebook.Initialize(facebookAppId, facebookAppSecret, "sqlloco");

    /* Routing rules
    */
    // REST API, locale in URL for locale independent files:
    // NOTE: Any folder added to the API folder need to be registered, and before the catch-all pages route
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/me/{page}/{*urldata}", "~/api/v1/me/{page}.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/users/{userID}", "~/api/v1/users/index.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/users/{userID}/{page}/{*urldata}", "~/api/v1/users/{page}.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/auth/{page}/{*urldata}", "~/api/v1/auth/{page}.cshtml");
    // DEPRECATED: Auth alias for previously used REST URLs (originally in the root of the REST URL)
    // TODO This URLs are deprecated, so at some point next 4 alias must be removed
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/facebook-user", "~/api/v1/auth/facebook-user.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/login/{*urldata}", "~/api/v1/auth/login.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/logout", "~/api/v1/auth/logout.cshtml");
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/signup/{*urldata}", "~/api/v1/auth/signup.cshtml");
    // Disabled experimental icalendar route
    //RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/icalendar/{page}", "~/api/v1/icalendar/{page}.cshtml");
    // Catch-all pages route, will route to any page inmediately in the API folder, or Not Found
    RouteTable.Routes.MapWebPageRoute("api/v1/{locale}/{page}/{*urldata}", "~/api/v1/{page}.cshtml");

    // ScheduledTask
    RouteTable.Routes.MapWebPageRoute("scheduledtask", "~/_specialRoutes/ScheduledTask.cshtml");
    // PaymentGatewayWebhook: hook URL to allow Braintree to contact us about transactions/merchant account information
    RouteTable.Routes.MapWebPageRoute("PaymentGatewayWebhook", "~/_specialRoutes/PaymentGatewayWebhook.cshtml");
    // iCalendar URL
    RouteTable.Routes.MapWebPageRoute("calendar/{userID}/{token}/{file}", "~/_specialRoutes/Calendar.cshtml");

    // Public User profile photo, KEEPING URL AS IN Release-6.3 FOR RELEASE-7+
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo", "~/_specialRoutes/UserProfilePhoto.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo/{userID}", "~/_specialRoutes/UserProfilePhoto.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/profile/photo/{userID}/{type}", "~/_specialRoutes/UserProfilePhoto.cshtml");

    // Auth
    RouteTable.Routes.MapWebPageRoute("{locale}/auth/login", "~/_specialRoutes/Login.cshtml");
    RouteTable.Routes.MapWebPageRoute("{locale}/auth/confirm", "~/_specialRoutes/Confirm.cshtml");
    RouteTable.Routes.MapWebPageRoute("auth/login", "~/_specialRoutes/Login.cshtml");
    RouteTable.Routes.MapWebPageRoute("auth/confirm", "~/_specialRoutes/Confirm.cshtml");

    // App/Webapp explicit rules
    // TODO: some day this list needs to be automatic, from the activity list, right now has some explicit rules to avoid conflicts with
    // more generic rules after this (the problematic is the customURL rule, basically)
    RouteTable.Routes.MapWebPageRoute("login/{*urldata}", "~/Default.cshtml");

    // Special Server ROUTES
    // Booking with service professional bookcode URL
    RouteTable.Routes.MapWebPageRoute("book/{bookcode}", "~/_specialRoutes/Book.cshtml");
    RouteTable.Routes.MapWebPageRoute("book/{bookcode}/{jobTitleID}", "~/_specialRoutes/Book.cshtml");
    // Public Profile URL optimized for SEO:
    RouteTable.Routes.MapWebPageRoute("{city}/{jobTitle}/{user}", "~/_specialRoutes/PublicProfileURL.cshtml");
    // CustomURL:
    RouteTable.Routes.MapWebPageRoute(LcRest.MarketplaceProfile.CustomUrlPrefix + "{customurl}/", "~/_specialRoutes/CustomURL.cshtml");
    // Refer professionals
    RouteTable.Routes.MapWebPageRoute("refer/", "~/_specialRoutes/refer.cshtml");


    /*
     * Because a false positive at the PCI Scan (2017-03-07, ScanID 7340331)
     * we need to prevent returning a success HTTP response to URLs that 
     * include "/webcart". That pages don't exists in our system, but we are
     * throwing a valid response to anything rather than not-found right now,
     * making the scan to 'believe' that we are returning sensitive data at that
     * URLs (when not).
     * 
     * The scan says:
     * > At least one of these file or directories is world readable : /webcart/orders/
     * /webcart/orders/import.txt /webcart/carts/ /webcart/config/
     * /webcart/config/clients.txt /webcart-lite/orders/import.txt
     * /webcart-lite/config/clients.txt This misconfiguration may allow an attacker to gather the
     * credit card numbers of your clients. See also : http://marc.info/?l=bugtraq&m=92462991805485&w=2
    */
    RouteTable.Routes.MapWebPageRoute("webcart/{*any}", "~/Errors/Error404.cshtml");
    RouteTable.Routes.MapWebPageRoute("webcart-lite/{*any}", "~/Errors/Error404.cshtml");

    // MANAGE SPA ROUTES REDIRECTING TO INDEX
    // CATCH-ALL:
    RouteTable.Routes.MapWebPageRoute("{*any}", "~/Default.cshtml");

    // IMPORTANT: because of the previous CATCH-ALL, this will never being displayed.
    // BUT is important to know how to do it, since is expected we can replace the catch-all by specific SPA page URLs
    // ANY NOT FOUND URL
    RouteTable.Routes.MapWebPageRoute("{*urldata}", "~/Errors/Error404.cshtml");
}
{'fraction_non_alphanumeric': 0.14043309631544926, 'fraction_numerical': 0.01098901098901099, 'mean_word_length': 4.260093497662559, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 4, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 14, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3178489', 'n_tokens_mistral': 3929, 'n_tokens_neox': 3777, 'n_words': 816}