All versions of TFS are affected by the ASP.net security vulnerability discovered recently. Brian Harry has blogged about this and attached a document on how to work around this problem until a patch is released. If you are a TFS admin you have some work to do…
It is almost two years since I encountered this problem but since I have still not found any good explanations I’ll just make a post about it myself and hope those who could use this info find their way in here.
.Net web-applikation using nested html tables which in turn uses stylesheets to set background color, font, font-size and so on. For some unknown reason the background color bleed outward/inward.
Set the actual html background color attribute to any color you like in all places where your stylesheet setting includes a background color. This stops the colors from bleeding. The stylesheet background color overrides the html attribute so you’ll get the color you want…
This might not sound like the perfect solution, but it works. We stumbled across it by accident after trying everything we could think of and everything related we could find on the internet.
Get a VS2003 ASP.NET web application project from SourceSafe, migrate to VS2005 and add to TFS source control. All done on a PC running Windows Vista. As VS2003 will not run on Vista opening the solution in VS2003 and disconnect it from source control is not possible… might be possible to do from SourceSafe, but I decided to give it a go and just open it in VS2005 straight away.
VS2005 conversion wizard fails to convert the web application. Depending on if I let the .sln file point to localhost or changed the projekt path to “C:\myAppPath\myWeb.vbproj” I get two different errors:
Error 1 (keeping localhost/myWeb/myWeb.vbproj as project path):
Conversion Issues – myWeb.vbproj
Thats it… No clue as to what is wrong.
Error 2 (changing to C:\myPath\myWeb.vbproj as project path):
Conversion Issues – myWeb.vbproj:
Unable to open the Web ‘C:\myPath\myWeb.vbproj’. The Web ‘C:\myPath\myWeb.vbproj’ does not exist.
Looks a bit more helpful, but since the file DOES exist… No, no more helpful than what I got in Error 1.
As it turned out there wasn’t really anything wrong with the myWeb.vbproj file. Except that it was write protected… Checking the “make writable” checkbox when getting the code from SourceSafe (or just removing the write protection from the file) made all the difference. VS2005 disconnects the code from SourceSafe source control and converts everything
Now I just need to solve all the compilation errors and the code will be ready to check into our TFS… Looking back, I might have been able to avoid the entire problem by following Microsoft’s instructions for migration. But why learn to swim when it is soooo simple to just jump into the deep end of the pool? Anyway, hope this is helpful to someone else…