The fix for the ASP.NET  security bug is now available in windows update. However, the change has a negative side effect for the current release of mojoPortal which may cause authenticated users to experience an error on your site. The error occurs when trying to decrypt the role cookie which was encrypted before the update was applied. Previously, if there was an error decrypting a role cookie, it was throwing a System.Security.Cryptography.CrypotgraphicException (which we were handling so the user would not experience any error). After the windows update it now throws a more generic HttpException which the current release does not handle so the user will see the error page, and the only way to solve it is to clear the cookie. I have added handling for the changed error for the next release of mojoPortal, but you may begin seeing this error after you or your host applies the security fix.

There is one workaround you can do right away to solve this problem, you can add code to the ErrorPage.aspx in the root to clear the role cookie so that at least the user will only see the error page one time. To do this, edit the ErrorPage.aspx file with a text editor. At the top add this:

<%@ Import Namespace="mojoPortal.Business" %>
<%@ Import Namespace="mojoPortal.Business.WebHelpers" %>
<%@ Import Namespace="mojoPortal.Web" %>

then add this code to the bottom of the Page_Load event:

after this existing line of code:

if (disposable != null) { disposable.Dispose(); }

add this:

try
        {
            SiteSettings siteSettings = CacheHelper.GetCurrentSiteSettings();
            if (siteSettings != null)
            {
                string roleCookieName = SiteUtils.GetRoleCookieName(siteSettings);
                HttpCookie roleCookie = new HttpCookie(roleCookieName, string.Empty);
                roleCookie.HttpOnly = true;
                roleCookie.Path = "/";
                HttpContext.Current.Response.Cookies.Add(roleCookie);
            }
        }
        catch{}

A big shout of thanks to the mojoPortal Community!

Thanks to your nominations, mojoPortal is a finalist in the 2010 Open Source Awards in the CMS Category.

Now the voting phase has begun and we need your vote! The voting phase goes from September 27, 2010 until November 5, 2010. Please take a moment and vote for mojoPortal! By voting, you also get a chance to win an Amazon Kindle.

https://www.packtpub.com/open-source-awards-home/vote-open-source-cms

The competition is always tough in these awards, so every vote is important. We really need your vote!

Follow us on twitter or become a fan on Facebook

I'm very gratified to announce that mojoPortal has won 3rd place in the 2009 CMS Awards by Packt Publishing, in the Non-PHP category. It is particularly exciting that mojoPortal was the only .NET based CMS to place this year, nudging out DotNetNuke in the Best Other category.

Plone, a Python based CMS retained their crown from last year, and dotCMS, a java based CMS took second place.

In 2007, the first year of the contest, mojoPortal actually won this category over the more established Plone, but we were the only .NET CMS among the contenders that year. In 2008 there were several other .NET projects in the mix and though we were a finalist in the Best Other category, DotNetNuke took 3rd place both in the Best Other and Best Overall Category. This year, after the nomination phase, DotNetNuke was a finalist again in both the Best Overall and Best Other categories and mojoPortal only made the finalists in the Best Other Category, so it seemed like they had already placed ahead of us again this year, but in the end we prevailed against the odds. 

It is a very competitive field and all the contending projects certainly deserve respect. While some have criticized the contest as being merely a popularity contest, I can't really say it seems that way to me. While mojoPortal's popularity is growing rapidly, we are still much less known than many of the projects in the competition. Certainly we were an underdog and no-where near as popular as Plone in 2007 when we won first place in the non-PHP category, and DotNetNuke clearly has a much larger user base, better brand recognition, and more marketing muscle backed by venture capital. So obviously there is more than vote counting going on. It would be nice if the judges post their individual analysis, at least one has already posted some notes about his impressions of the contenders and I know some of the other judges are planning to do the same.

Follow us on twitter or become a fan on Facebook

Hey mojoPortal friends, tomorrow (October 30, 2009) is the last day of voting in the 2009 CMS Awards by Packt Publishing.

If you haven't already voted please vote, we need your support!

Results wil be announced on November 10.

Thought I would make a brief post to share the progress in growth of the mojoPortal community and other statistics and milestones of interest.

In recent weeks we reached 5000 commits in our svn source code repository, actually the most recent revision as of this writing is r5086.

We are approaching 5000 voluntary site registrations and could possibly even reach that milestone this month. The chart below is as of 2009-05-09.

Web Traffic is doing well and showing steady growth.

And best of all, downloads have suddenly gone way up from the exposure we have received in the Microsoft Web Application Gallery. You can see, we went live in the gallery on April 6-7 and its been like a tidal wave raisin our 30 day downloads from 3500-3800 previous average to over 18,000  downloads on the current live stats chart.

A little love from Microsoft goes a long way as you can see! Huge thanks to Microsoft and especially the IIS Team for their support and help in getting mojoPortal into the gallery.

The interesting thing to me is that the site registration chart was already going parabolic before we got into the gallery. We got into the gallery around April 6-7, and site registration actually dipped a little in April compared to March. It will be interesting to see where it goes from here. Note that we have never required registration to download or even tried to fool people into thinking they can't download without registration like DotNetNuke does. Our registration numbers mean more because they are strictly voluntary.