CVE-2022-0159: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-12T03:15Z
Repository: https://github.com/orchardcms/orchardcore
Language: Other
Files changed: src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs, src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml, src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs, src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml, src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml, src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml, src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml, src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml, src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml, src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml, src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml, src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml, src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml, src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml
Commit date: 2022-01-11 07:23:58 -0800
Commit message: Fix encoding issues (#11008)


Diff: diff --git a/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs b/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs
index b0b98bd09..bc2c9c6e0 100644
--- a/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs
+++ b/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Controllers/DashboardController.cs
@@ -122,11 +122,11 @@ namespace OrchardCore.AdminDashboard.Controllers
                 var contentItem = await _contentManager.NewAsync(ctd.Name);
                 contentItem.Owner = User.FindFirstValue(ClaimTypes.NameIdentifier);
                 var authorized = await _authorizationService.AuthorizeAsync(User, CommonPermissions.EditContent, contentItem);
                 if (authorized)
                 {
-                    dashboardCreatable.Add(new SelectListItem(new LocalizedString(ctd.DisplayName, ctd.DisplayName).Value, ctd.Name));
+                    dashboardCreatable.Add(new SelectListItem(ctd.DisplayName, ctd.Name));
                 }
             }
 
             var widgets = await _adminDashboardService.GetWidgetsAsync(x => x.Latest);
             var wrappers = new List<DashboardWrapper>();
diff --git a/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml b/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml
index 29add904e..c87088d5f 100644
--- a/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.AdminDashboard/Views/Dashboard/Manage.cshtml
@@ -30,11 +30,11 @@
                 @T["Add Widget"]
             </button>
             <div class="dropdown-menu dropdown-menu-right scrollable" aria-labelledby="bulk-action-menu-button">
                 @foreach (var item in Model.Creatable)
                 {
-                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
+                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
                 }
             </div>
         </div>
     }
 </div>
diff --git a/src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs b/src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs
index 682ebe2e4..f158ed3fd 100644
--- a/src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs
+++ b/src/OrchardCore.Modules/OrchardCore.Contents/Controllers/AdminController.cs
@@ -136,11 +136,11 @@ namespace OrchardCore.Contents.Controllers
                     var contentItem = await _contentManager.NewAsync(contentTypeDefinition.Name);
                     contentItem.Owner = context.User.FindFirstValue(ClaimTypes.NameIdentifier);
 
                     if (await _authorizationService.AuthorizeAsync(context.User, CommonPermissions.EditContent, contentItem))
                     {
-                        creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
+                        creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
                     }
                 }
 
                 options.CreatableTypes = creatableList;
             }
@@ -155,11 +155,11 @@ namespace OrchardCore.Contents.Controllers
                         var contentItem = await _contentManager.NewAsync(contentTypeDefinition.Name);
                         contentItem.Owner = context.User.FindFirstValue(ClaimTypes.NameIdentifier);
 
                         if (await _authorizationService.AuthorizeAsync(context.User, CommonPermissions.EditContent, contentItem))
                         {
-                            creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
+                            creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
                         }
                     }
                 }
 
                 options.CreatableTypes = creatableList;
diff --git a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml
index bc4fcaead..60d33d981 100644
--- a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Create.cshtml
@@ -8,11 +8,11 @@
     ContentItem contentItem = Model.ContentItem;
     var contentTypeDefinition = ContentDefinitionManager.GetTypeDefinition(contentItem.ContentType);
     var typeDisplayName = contentTypeDefinition?.DisplayName ?? contentItem.ContentType.CamelFriendly();
 }
 
-<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", Html.Raw(typeDisplayName)])</h1></zone>
+<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", typeDisplayName])</h1></zone>
 
 <form asp-action="Create" asp-route-returnUrl="@Context.Request.Query["ReturnUrl"]" method="post" enctype="multipart/form-data" class="no-multisubmit">
     @Html.ValidationSummary()
     @await DisplayAsync(Model)
 </form>
diff --git a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml
index 3f5d9b350..2d996fee5 100644
--- a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Admin/Edit.cshtml
@@ -8,11 +8,11 @@
     ContentItem contentItem = Model.ContentItem;
     var contentTypeDefinition = ContentDefinitionManager.GetTypeDefinition(contentItem.ContentType);
     var typeDisplayName = contentTypeDefinition?.DisplayName ?? contentItem.ContentType.CamelFriendly();
 }
 
-<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", Html.Raw(typeDisplayName)])</h1></zone>
+<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", typeDisplayName])</h1></zone>
 
 <form asp-action="Edit" asp-route-contentitemid="@contentItem.ContentItemId" asp-route-returnUrl="@Context.Request.Query["ReturnUrl"]" method="post" enctype="multipart/form-data" class="no-multisubmit">
     @Html.ValidationSummary()
     @await DisplayAsync(Model)
 </form>
diff --git a/src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml b/src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml
index 362a76f33..129d56e8f 100644
--- a/src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Contents/Views/ContentsAdminListCreate.cshtml
@@ -14,11 +14,11 @@
                         @T["New"]
                     </button>
                     <div class="dropdown-menu dropdown-menu-right scrollable" aria-labelledby="bulk-action-menu-button">
                         @foreach (var item in Model.CreatableTypes)
                         {
-                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
+                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
                         }
                     </div>
                 </div>
             }
         }
diff --git a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml
index 4e8153227..38bb289ad 100644
--- a/src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Contents/Views/Download/Display.cshtml
@@ -11,11 +11,11 @@
 <style asp-name="codemirror"></style>
 <script asp-name="codemirror" depends-on="admin" at="Foot"></script>
 <script asp-name="codemirror-addon-display-autorefresh" at="Foot"></script>
 <script asp-name="codemirror-mode-javascript" at="Foot"></script>
 
-<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", Html.Raw(typeDisplayName)])</h1></zone>
+<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", typeDisplayName])</h1></zone>
 
 <form asp-action="Download" asp-route-contentItemId="@contentItem.ContentItemId" method="post" enctype="multipart/form-data" class="no-multisubmit">
     <div class="form-group">
         <div class="d-flex flex-row-reverse">
             <div class="btn">
diff --git a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml
index 253598250..0012ac4ac 100644
--- a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Admin/Hello.cshtml
@@ -27,10 +27,10 @@
 </p>
 <p>
     Being an Admin Page my default path based route is automatically prefixed with the current 'AdminOptions.AdminUrlPrefix'.
 </p>
 <p>
-    @T[Model.Message]
+    @Model.Message
 </p>
 <p>
     Date using the DateTimeShape: @await DisplayAsync(await New.DateTime(Utc: null, Format: T["MMMM dd, yyyy"].Value))
 </p>
diff --git a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml
index 470c894cb..3ae09239b 100644
--- a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/Hello.cshtml
@@ -20,10 +20,10 @@
 @await Html.PartialAsync("Header", Model)
 
 <h2>Hello from @ViewContext.RouteData.Values["page"]</h2>
 
 <p>
-    @T[Model.Message]
+    @Model.Message
 </p>
 <p>
     Date using the DateTimeShape: @await DisplayAsync(await New.DateTime(Utc: null, Format: T["MMMM dd, yyyy"].Value))
 </p>
diff --git a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml
index 15af3315e..cb7b762fd 100644
--- a/src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Demo/Pages/OutsideAdmin.cshtml
@@ -29,10 +29,10 @@
 </p>
 <p>
     Being an Admin Page my default path based route is automatically prefixed with the current 'AdminOptions.AdminUrlPrefix'.
 </p>
 <p>
-    @T[Model.Message]
+    @Model.Message
 </p>
 <p>
     Date using the DateTimeShape: @await DisplayAsync(await New.DateTime(Utc: null, Format: T["MMMM dd, yyyy"].Value))
 </p>
diff --git a/src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml b/src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml
index 322a72fb8..338d8a1c1 100644
--- a/src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowMetadata.Edit.cshtml
@@ -21,11 +21,11 @@
     </div>
 </div>
 
 <div class="btn-group btn-group-sm" role="group">
     <button type="button" class="btn btn-secondary btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-        @T[Model.Size + "%"]
+        @T[Html.Encode(Model.Size + "%")] @* Allows for custom string reprentations like half, quarter, ...*@
     </button>
     <div class="dropdown-menu btn-group-toggle" data-toggle="buttons">
         <label class="btn btn-secondary dropdown-item @(Model.Size == 25 ? "active" : null)">
             <input asp-for="Size" id="@Html.IdFor(x => x.Size)_25" type="radio" autocomplete="off" value="25">@T["25%"]
         </label>
diff --git a/src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml b/src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml
index 65564eab4..275ed07d8 100644
--- a/src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Layers/Views/Admin/Index.cshtml
@@ -49,11 +49,11 @@
                             {
                                 <div class="form-group">
                                     <ul class="list-group zones">
                                         @foreach (var contentItemSummary in Model.Widgets[zone])
                                         {
-                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + contentItemSummary.ContentItem.Content.LayerMetadata.Layer + "</span>"));
+                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + Html.Encode(contentItemSummary.ContentItem.Content.LayerMetadata.Layer) + "</span>"));
                                             maxPosition = Math.Max(maxPosition, (double)contentItemSummary.ContentItem.Content.LayerMetadata.Position);
 
                                             <text>
                                                 <li class="list-group-item">
                                                     <div class="properties cursor-move">
diff --git a/src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml b/src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml
index 0f191f441..1ddabab66 100644
--- a/src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Users/Views/RegistrationSettings.Edit.cshtml
@@ -12,11 +12,20 @@
 <div class="form-group" asp-validation-class-for="UsersCanRegister">
     <label asp-for="UsersCanRegister">@T["Configure users registration."]</label>
     <select asp-for="UsersCanRegister" class="form-control">
         @foreach (UserRegistrationType option in Enum.GetValues(typeof(UserRegistrationType)))
         {
-            <option value="@option" selected="@(Model.UsersCanRegister == option)">@T[option.ToString()]</option>
+            <option value="@option" selected="@(Model.UsersCanRegister == option)">
+                @{
+                    switch (option)
+                    {
+                        case UserRegistrationType.NoRegistration: @T["NoRegistration"]; break;
+                        case UserRegistrationType.AllowRegistration: @T["AllowRegistration"]; break;
+                        case UserRegistrationType.AllowOnlyExternalUsers: @T["AllowOnlyExternalUsers"]; break;
+                    }
+                }
+            </option>
         }
     </select>
     <span asp-validation-for="UsersCanRegister"></span>
 
     <div class="hint">
diff --git a/src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml b/src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml
index 7b7c340cb..0b7abd43b 100644
--- a/src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml
+++ b/src/OrchardCore.Modules/OrchardCore.Workflows/Views/Content.UserTaskButton.cshtml
@@ -6,16 +6,16 @@
 @if (actions.Count <= 2)
 {
     @foreach (var action in actions)
     {
         <div class="btn-group" role="group">
-            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[action] @T["and Save"]</button>
+            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
             <button type="button" class="btn btn-warning dropdown-toggle dropdown-toggle-split" data-reference="parent" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
                 <span class="sr-only">@T["Toggle Dropdown"]</span>
             </button>
             <div class="dropdown-menu" aria-labelledby="userActionsButtonGroup">
-                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>
+                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>
             </div>
         </div>
     }
 }
 else
@@ -25,11 +25,11 @@ else
             @T["User Actions"]
         </button>
         <div class="dropdown-menu" aria-labelledby="userActionsButtonGroup">
             @foreach (var action in actions)
             {
-                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[action] @T["and Save"]</button>
-                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>
+                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
+                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>
             }
         </div>
     </div>
 }

Vulnerable code:                     dashboardCreatable.Add(new SelectListItem(new LocalizedString(ctd.DisplayName, ctd.DisplayName).Value, ctd.Name));
                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
                        creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
                            creatableList.Add(new SelectListItem(new LocalizedString(contentTypeDefinition.DisplayName, contentTypeDefinition.DisplayName).Value, contentTypeDefinition.Name));
<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", Html.Raw(typeDisplayName)])</h1></zone>
<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", Html.Raw(typeDisplayName)])</h1></zone>
                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[item.Text]</a>
<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", Html.Raw(typeDisplayName)])</h1></zone>
    @T[Model.Message]
    @T[Model.Message]
    @T[Model.Message]
        @T[Model.Size + "%"]
                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + contentItemSummary.ContentItem.Content.LayerMetadata.Layer + "</span>"));
            <option value="@option" selected="@(Model.UsersCanRegister == option)">@T[option.ToString()]</option>
            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[action] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>
                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[action] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[action] @T["and Publish"]</button>
Fixed code:                     dashboardCreatable.Add(new SelectListItem(ctd.DisplayName, ctd.Name));
                    <a class="dropdown-item add-list-widget btn-sm" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
                        creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
                            creatableList.Add(new SelectListItem(contentTypeDefinition.DisplayName, contentTypeDefinition.Name));
<zone Name="Title"><h1>@RenderTitleSegments(T["New {0}", typeDisplayName])</h1></zone>
<zone Name="Title"><h1>@RenderTitleSegments(T["Edit {0}", typeDisplayName])</h1></zone>
                            <a class="dropdown-item" href="@Url.RouteUrl(new { area = "OrchardCore.Contents", controller = "Admin", action = "Create", id = @item.Value, returnUrl = FullRequestPath })">@T[Html.Encode(item.Text)]</a>
<zone Name="Title"><h1>@RenderTitleSegments(T["View As JSON {0}", typeDisplayName])</h1></zone>
    @Model.Message
    @Model.Message
    @Model.Message
        @T[Html.Encode(Model.Size + "%")] @* Allows for custom string reprentations like half, quarter, ...*@
                                            await contentItemSummary.Tags.AddAsync(Html.Raw("<span class=\"badge ta-badge font-weight-normal\"><i class=\"fa fa-bookmark-o text-info\" aria-hidden=\"true\"></i> " + Html.Encode(contentItemSummary.ContentItem.Content.LayerMetadata.Layer) + "</span>"));
            <option value="@option" selected="@(Model.UsersCanRegister == option)">
                @{
                    switch (option)
                    {
                        case UserRegistrationType.NoRegistration: @T["NoRegistration"]; break;
                        case UserRegistrationType.AllowRegistration: @T["AllowRegistration"]; break;
                        case UserRegistrationType.AllowOnlyExternalUsers: @T["AllowOnlyExternalUsers"]; break;
                    }
                }
            </option>
            <button class="btn btn-warning" type="submit" name="submit.Save" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>
                <button type="submit" name="submit.Save" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Save"]</button>
                <button type="submit" name="submit.Publish" class="dropdown-item" value="user-task.@action">@T[Html.Encode(action)] @T["and Publish"]</button>