using System; using System.Collections.Generic; using System.Security.Claims; using System.Security.Principal; using System.Web; using System.Web.Security; using System.Web.UI; using System.Web.UI.WebControls; using AyABL.AUT.Encripta; public partial class SiteMaster : MasterPage { private const string AntiXsrfTokenKey = "__AntiXsrfToken"; private const string AntiXsrfUserNameKey = "__AntiXsrfUserName"; private string _antiXsrfTokenValue; EncriptaBL objEncriptaBL; protected void Page_Init(object sender, EventArgs e) { // El código siguiente ayuda a proteger frente a ataques XSRF var requestCookie = Request.Cookies[AntiXsrfTokenKey]; Guid requestCookieGuidValue; if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue)) { // Utilizar el token Anti-XSRF de la cookie _antiXsrfTokenValue = requestCookie.Value; Page.ViewStateUserKey = _antiXsrfTokenValue; } else { // Generar un nuevo token Anti-XSRF y guardarlo en la cookie _antiXsrfTokenValue = Guid.NewGuid().ToString("N"); Page.ViewStateUserKey = _antiXsrfTokenValue; var responseCookie = new HttpCookie(AntiXsrfTokenKey) { HttpOnly = true, Value = _antiXsrfTokenValue }; if (FormsAuthentication.RequireSSL && Request.IsSecureConnection) { responseCookie.Secure = true; } Response.Cookies.Set(responseCookie); } Page.PreLoad += master_Page_PreLoad; if (Request.Form["__EVENTTARGET"] == "Inicio") { btnInicio_Click(this, new EventArgs()); } else if (Request.Form["__EVENTTARGET"] == "finSession") { btnFin_Click(this, new EventArgs()); } else if (Request.Form["__EVENTTARGET"] == "Ayuda") { btnAyuda_Click(this, new EventArgs()); } } protected void master_Page_PreLoad(object sender, EventArgs e) { if (!IsPostBack) { // Establecer token Anti-XSRF ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey; ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty; } else { // Validar el token Anti-XSRF if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue || (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty)) { throw new InvalidOperationException("Error de validación del token Anti-XSRF."); } } } protected void Page_Load(object sender, EventArgs e) { try { if (!IsPostBack) { General gr = new General(); gr.MensajeInformativo(AyABL.BASESDEDATOS.ADS + "Interfaz: " + AyABL.RCS.MensajesAplicacion.SesionExpiro.ToString()); lblUsuarioLogueado.Text = "Bienvenido " + Session["LOGIN"].ToString(); lblRol.Text = Session["ROL"].ToString(); } } catch (Exception ex) { // General gr = new General(); // gr.MensajeInformativo(AyABL.BASESDEDATOS.ADS + "Interfaz: " + AyABL.RCS.MensajesAplicacion.SesionExpiro.ToString()); Response.Redirect("../wfrLogin.aspx?sesion=expiro", false); //throw new InvalidOperationException("La sesión ha expirado"); } } protected void Unnamed_LoggingOut(object sender, LoginCancelEventArgs e) { Context.GetOwinContext().Authentication.SignOut(); } protected void btnAyuda_Click(object sender, EventArgs e) { try { objEncriptaBL = new EncriptaBL(); Response.Redirect("~/Forms/Ayuda/frwAyuda.aspx" + "?l=" + objEncriptaBL.Encryptar(Session["LOGIN"].ToString()) + "&u=" + objEncriptaBL.Encryptar(Session["PKUSUARIO"].ToString())); } catch (Exception ex) { } } protected void btnInicio_Click(object sender, EventArgs e) { objEncriptaBL = new EncriptaBL(); Response.Redirect("~/Forms/frwIndex.aspx" + "?l=" + objEncriptaBL.Encryptar(Session["LOGIN"].ToString()) + "&u=" + objEncriptaBL.Encryptar(Session["PKUSUARIO"].ToString())); } protected void btnFin_Click(object sender, EventArgs e) { Session.Abandon(); Session["LOGIN"] = null; Session["PKUSUARIO"] = null; Response.Redirect("~/Forms/wfrLogin.aspx"); } }