Program: CWE-434
Project: CVE-2014-10074
Buggy source:
<?xml version="1.0" encoding="utf-8" ?>
<settings>
  <content>
    <imaging>
      <!-- what file extension that should cause umbraco to create thumbnails -->
      <imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif</imageFileTypes>
      <!-- what attributes that are allowed in the editor on an img tag -->
      <allowedAttributes>src,alt,border,class,style,align,id,name,onclick,usemap</allowedAttributes>
      <!-- automatically updates dimension, filesize and extension attributes on upload -->
      <autoFillImageProperties>
        <uploadField alias="umbracoFile">
          <widthFieldAlias>umbracoWidth</widthFieldAlias>
          <heightFieldAlias>umbracoHeight</heightFieldAlias>
          <lengthFieldAlias>umbracoBytes</lengthFieldAlias>
          <extensionFieldAlias>umbracoExtension</extensionFieldAlias>
        </uploadField>
      </autoFillImageProperties>
      
    </imaging>
    <scripteditor>
      <!-- Path to script folder - no ending "/" -->
      <scriptFolderPath>/scripts</scriptFolderPath>
      <!-- what files can be opened/created in the script editor -->
      <scriptFileTypes>js,xml</scriptFileTypes>
      <!-- disable the codemirror editor and use a simple textarea instead -->
      <scriptDisableEditor>false</scriptDisableEditor>
    </scripteditor>

    <!-- should umbraco store the uploaded files like /media/xxx/filename.ext or like /media/xxx-filename.ext
		should be set to false if the application pool's user account hasn't got readrights of the driveroot up to the /media directory -->
    <UploadAllowDirectories>True</UploadAllowDirectories>
    <errors>
      <!-- the id of the page that should be shown if the page is not found -->
      <!--<error404>
                   <errorPage culture="default">1</errorPage>
                   <errorPage culture="en-US">200</errorPage>
            </error404>-->
      <error404>
        <errorPage culture="default">1</errorPage>
      </error404>
    </errors>
    <notifications>
      <!-- the email that should be used as from mail when umbraco sends a notification -->
      <email>your@email.here</email>
    </notifications>

    <!-- if true umbraco will ensure that no page under the same parent has an identical name -->
    <ensureUniqueNaming>True</ensureUniqueNaming>

    <!-- clean editor content with use of tidy -->
    <TidyEditorContent>False</TidyEditorContent>

    <!-- the encoding type for tidy. Default is UTF8, options are ASCII, Raw, Latin1, UTF8, ISO2022, MacroMan-->
    <TidyCharEncoding>UTF8</TidyCharEncoding>

    <!-- to enable new content schema, this needs to be false -->
    <UseLegacyXmlSchema>false</UseLegacyXmlSchema>

    <!-- Whether to force safe aliases (no spaces, no special characters) at businesslogic level on contenttypes and propertytypes -->
    <!-- HIGHLY recommend to keep this to true to ensure valid and beautiful XML Schemas -->
    <ForceSafeAliases>true</ForceSafeAliases>

    <!-- Enable / disable xml content cache -->
    <XmlCacheEnabled>True</XmlCacheEnabled>

    <!-- Update disk cache every time content has changed -->
    <ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>

    <!-- Update in-memory cache if xml file is changed -->
    <XmlContentCheckForDiskChanges>False</XmlContentCheckForDiskChanges>

    <!-- Show the /config/splashes/booting.aspx page while initializing content -->
    <EnableSplashWhileLoading>False</EnableSplashWhileLoading>

    <!-- Show property descriptions in editing view "icon|text|none" -->
    <PropertyContextHelpOption>text</PropertyContextHelpOption>

    <!-- The html injected into a (x)html page if Umbraco is running in preview mode -->
    <PreviewBadge>
      <![CDATA[<a id="umbracoPreviewBadge" style="position: absolute; top: 0; right: 0; border: 0; width: 149px; height: 149px; background: url('{1}/preview/previewModeBadge.png') no-repeat;" href="#" OnClick="javascript:window.top.location.href = '{0}/endPreview.aspx?redir={2}'"><span style="display:none;">In Preview Mode - click to end</span></a>
    ]]></PreviewBadge>

    <!-- Cache cycle of Media and Member data fetched from the umbraco.library methods -->
    <!-- In seconds. 0 will disable cache -->
    <UmbracoLibraryCacheDuration>1800</UmbracoLibraryCacheDuration>

    <!-- Url Resolving ensures that all links works if you run Umbraco in virtual directories -->
    <!-- Setting this to true can increase render time for pages with a large number of links -->
    <!-- If running Umbraco in virtual directory this *must* be set to true! -->
    <ResolveUrlsFromTextString>false</ResolveUrlsFromTextString>

    <!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
         - inline - show an inline error within the macro but allow the page to continue rendering. Historial Umbraco behaviour.
         - silent - Silently suppress the error and do not render the offending macro.
         - throw  - Throw an exception which can be caught by the global error handler defined in Application_OnError. If no such
                    error handler is defined then you'll see the Yellow Screen Of Death (YSOD) error page.
         Note the error can also be handled by the umbraco.macro.Error event, where you can log/alarm with your own code and change the behaviour per event. -->
    <MacroErrors>throw</MacroErrors>
    
    <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg</disallowedUploadFiles>

    <!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
    <defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>
  </content>

  <security>
    <!-- set to true to auto update login interval (and there by disabling the lock screen -->
    <keepUserLoggedIn>true</keepUserLoggedIn>

    <!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
    <hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
    
  </security>

  <requestHandler>
    <!-- this will ensure that urls are unique when running with multiple root nodes -->
    <useDomainPrefixes>false</useDomainPrefixes>
    <!-- this will add a trailing slash (/) to urls when in directory url mode -->
    <addTrailingSlash>true</addTrailingSlash>
    <urlReplacing removeDoubleDashes="true">
      <char org=" ">-</char>
      <char org="&quot;"></char>
      <char org="'"></char>
      <char org="%"></char>
      <char org="."></char>
      <char org=";"></char>
      <char org="/"></char>
      <char org="\"></char>
      <char org=":"></char>
      <char org="#"></char>
      <char org="+">plus</char>
      <char org="*">star</char>
      <char org="&amp;"></char>
      <char org="?"></char>
      <char org="æ">ae</char>
      <char org="ø">oe</char>
      <char org="å">aa</char>
      <char org="ä">ae</char>
      <char org="ö">oe</char>
      <char org="ü">ue</char>
      <char org="ß">ss</char>
      <char org="Ä">ae</char>
      <char org="Ö">oe</char>
      <char org="|">-</char>
      <char org="&lt;"></char>
      <char org="&gt;"></char>
    </urlReplacing>
  </requestHandler>

  <templates>
    <!-- If you want to switch to Mvc then do NOT change useAspNetMasterPages to false -->
    <!-- This (old!) setting is still used to control how macros are inserted into your pages -->
    <useAspNetMasterPages>true</useAspNetMasterPages>

    <!-- To switch the default rendering engine to MVC, change this value from WebForms to Mvc -->
    <!-- Do not set useAspNetMasterPages to false, it is not relevant to MVC usage -->
    <defaultRenderingEngine>Mvc</defaultRenderingEngine>
  </templates>


  <!-- this is used by Umbraco to determine if there's valid classes in the /App_Code folder to be used for Rest/XSLT extensions -->
  <developer>
    <appCodeFileExtensions>
      <ext>cs</ext>
      <ext>vb</ext>
    </appCodeFileExtensions>
  </developer>

  <scripting>
    <razor>
      <!-- razor DynamicNode typecasting detects XML and returns DynamicXml - Root elements that won't convert to DynamicXml -->
      <notDynamicXmlDocumentElements>
        <element>p</element>
        <element>div</element>
        <element>ul</element>
        <element>span</element>
      </notDynamicXmlDocumentElements>
      <dataTypeModelStaticMappings>
        <!--
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping documentTypeAlias="textPage" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" documentTypeAlias="textPage" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" documentTypeAlias="textPage">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            -->
      </dataTypeModelStaticMappings>
    </razor>
  </scripting>

  <!-- This moves the asp.net viewstate data to the end of the html document instead of having it in the beginning-->
  <viewstateMoverModule enable="false" />

  <!-- 
		Now that we have Log4Net logging enabled, this section is only used for what gets logged to the umbracoLog table
		which currently logs items used in the audit trail and roll back scenarios.
		-->
  <logging>
    <enableLogging>true</enableLogging>
    <enableAsyncLogging>true</enableAsyncLogging>
    <disabledLogTypes>
      <!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
    </disabledLogTypes>
    <!-- You can add your own logging tool by implementing the umbraco.BusinessLogic.Interfaces.ILog interface and add the reference here -->
    <!-- The external logger can also act as the audit trail storage by setting the logAuditTrail attribute to true -->
    <!--<externalLogger assembly="~/bin/assemblyFileName.dll" type="fully.qualified.namespace.and.type" logAuditTrail="false" /> -->
  </logging>

  <scheduledTasks>
    <!-- add tasks that should be called with an interval (seconds) -->
    <!--    <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
  </scheduledTasks>

  <!-- distributed calls must be enabled when using Umbraco in a load balanced environment -->
  <distributedCall enable="false">
    <!-- the id of the user who's making the calls -->
    <!-- needed for security, umbraco will automatically look up correct login and passwords -->
    <user>0</user>

    <!--
    When distributed call is enabled, you need to add all of the servers part taking in load balancing
    to the server list below. 
    -->

    <servers>

      <!-- 
      Add ip number or hostname, make sure that it can be reached from all servers
      you can also add optional attributes to force a protocol or port number.
      
      Examples:
      
      <server>127.0.0.1</server>
      <server forceProtocol="http|https" forcePortnumber="80|443">127.0.0.1</server>
      
      Generally when setting up load balancing you will designate a 'master' server, 
      Umbraco will always assume that the FIRST server listed in this list is the 'master'.
      (NOTE: Not all load balancing scenarios have a 'master', depends on how you are setting it up)
      
      In order for scheduled tasks (including scheduled publishing) to work properly when load balancing, each 
      server in the load balanced environment needs to know if it is the 'master'. In order for servers
      to know this or not, they need to compare some values against the servers listed. These values
      are either: serverName or appId. You should not enter both values but appId will always supersede serverName.
      The serverName is the easiest and will work so long as you are not load balancing your site on the same server.
      If you are doing this, then you will need to use appId which is equivalent to the value returned from
      HttpRuntime.AppDomainAppId. It is recommended that you set either the serverName or appId for all servers 
      registered here if possible, not just the first one.
      
      Examples:
      
      <server serverName="MyServer">server1.mysite.com</server>      
      <server appId="/LM/W3SVC/69/ROOT">server1.mysite.com</server>      
      -->
     
      
    </servers>
  </distributedCall>

  <!-- Configuration for repositories -->
  <!-- Add or remove repositories here. You will need the repository's unique key to be able to connect to it.-->
  <repositories>
    <repository name="Umbraco package Repository" guid="65194810-1f85-11dd-bd0b-0800200c9a66" />
  </repositories>

  <providers>
    <users>
      <!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
      <!-- specify it here (remember to add it to the web.config as well) -->
      <DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
    </users>
  </providers>

  <!-- Maps language, usertype, application and application_url to help pages -->
  <help defaultUrl="http://our.umbraco.org/wiki/umbraco-help/{0}/{1}">
    <!-- Add links that should open custom help pages -->
    <!--<link application="content" applicationUrl="dashboard.aspx"  language="en" userType="Administrators" helpUrl="http://www.xyz.no?{0}/{1}/{2}/{3}" /> -->
  </help>

  <!-- 
    web.routing
      @trySkipIisCustomErrors
        Tries to skip IIS custom errors.
        Starting with IIS 7.5, this must be set to true for Umbraco 404 pages to show. Else, IIS will take
        over and render its build-in error page. See MS doc for HttpResponseBase.TrySkipIisCustomErrors.
        The default value is false, for backward compatibility reasons, which means that IIS _will_ take
        over, and _prevent_ Umbraco 404 pages to show.
      @internalRedirectPreservesTemplate
        By default as soon as we're not displaying the initial document, we reset the template set by the
        finder or by the alt. template. Set this option to true to preserve the template set by the finder
        or by the alt. template, in case of an internal redirect.
        (false by default, and in fact should remain false unless you know what you're doing)
  -->
  <web.routing
    trySkipIisCustomErrors="false"
    internalRedirectPreservesTemplate="false">
  </web.routing>

</settings>

Fixed version (ground truth):
<?xml version="1.0" encoding="utf-8" ?>
<settings>
  <content>
    <imaging>
      <!-- what file extension that should cause umbraco to create thumbnails -->
      <imageFileTypes>jpeg,jpg,gif,bmp,png,tiff,tif</imageFileTypes>
      <!-- what attributes that are allowed in the editor on an img tag -->
      <allowedAttributes>src,alt,border,class,style,align,id,name,onclick,usemap</allowedAttributes>
      <!-- automatically updates dimension, filesize and extension attributes on upload -->
      <autoFillImageProperties>
        <uploadField alias="umbracoFile">
          <widthFieldAlias>umbracoWidth</widthFieldAlias>
          <heightFieldAlias>umbracoHeight</heightFieldAlias>
          <lengthFieldAlias>umbracoBytes</lengthFieldAlias>
          <extensionFieldAlias>umbracoExtension</extensionFieldAlias>
        </uploadField>
      </autoFillImageProperties>
      
    </imaging>
    <scripteditor>
      <!-- Path to script folder - no ending "/" -->
      <scriptFolderPath>/scripts</scriptFolderPath>
      <!-- what files can be opened/created in the script editor -->
      <scriptFileTypes>js,xml</scriptFileTypes>
      <!-- disable the codemirror editor and use a simple textarea instead -->
      <scriptDisableEditor>false</scriptDisableEditor>
    </scripteditor>

    <!-- should umbraco store the uploaded files like /media/xxx/filename.ext or like /media/xxx-filename.ext
		should be set to false if the application pool's user account hasn't got readrights of the driveroot up to the /media directory -->
    <UploadAllowDirectories>True</UploadAllowDirectories>
    <errors>
      <!-- the id of the page that should be shown if the page is not found -->
      <!--<error404>
                   <errorPage culture="default">1</errorPage>
                   <errorPage culture="en-US">200</errorPage>
            </error404>-->
      <error404>
        <errorPage culture="default">1</errorPage>
      </error404>
    </errors>
    <notifications>
      <!-- the email that should be used as from mail when umbraco sends a notification -->
      <email>your@email.here</email>
    </notifications>

    <!-- if true umbraco will ensure that no page under the same parent has an identical name -->
    <ensureUniqueNaming>True</ensureUniqueNaming>

    <!-- clean editor content with use of tidy -->
    <TidyEditorContent>False</TidyEditorContent>

    <!-- the encoding type for tidy. Default is UTF8, options are ASCII, Raw, Latin1, UTF8, ISO2022, MacroMan-->
    <TidyCharEncoding>UTF8</TidyCharEncoding>

    <!-- to enable new content schema, this needs to be false -->
    <UseLegacyXmlSchema>false</UseLegacyXmlSchema>

    <!-- Whether to force safe aliases (no spaces, no special characters) at businesslogic level on contenttypes and propertytypes -->
    <!-- HIGHLY recommend to keep this to true to ensure valid and beautiful XML Schemas -->
    <ForceSafeAliases>true</ForceSafeAliases>

    <!-- Enable / disable xml content cache -->
    <XmlCacheEnabled>True</XmlCacheEnabled>

    <!-- Update disk cache every time content has changed -->
    <ContinouslyUpdateXmlDiskCache>True</ContinouslyUpdateXmlDiskCache>

    <!-- Update in-memory cache if xml file is changed -->
    <XmlContentCheckForDiskChanges>False</XmlContentCheckForDiskChanges>

    <!-- Show the /config/splashes/booting.aspx page while initializing content -->
    <EnableSplashWhileLoading>False</EnableSplashWhileLoading>

    <!-- Show property descriptions in editing view "icon|text|none" -->
    <PropertyContextHelpOption>text</PropertyContextHelpOption>

    <!-- The html injected into a (x)html page if Umbraco is running in preview mode -->
    <PreviewBadge>
      <![CDATA[<a id="umbracoPreviewBadge" style="position: absolute; top: 0; right: 0; border: 0; width: 149px; height: 149px; background: url('{1}/preview/previewModeBadge.png') no-repeat;" href="#" OnClick="javascript:window.top.location.href = '{0}/endPreview.aspx?redir={2}'"><span style="display:none;">In Preview Mode - click to end</span></a>
    ]]></PreviewBadge>

    <!-- Cache cycle of Media and Member data fetched from the umbraco.library methods -->
    <!-- In seconds. 0 will disable cache -->
    <UmbracoLibraryCacheDuration>1800</UmbracoLibraryCacheDuration>

    <!-- Url Resolving ensures that all links works if you run Umbraco in virtual directories -->
    <!-- Setting this to true can increase render time for pages with a large number of links -->
    <!-- If running Umbraco in virtual directory this *must* be set to true! -->
    <ResolveUrlsFromTextString>false</ResolveUrlsFromTextString>

    <!-- How Umbraco should handle errors during macro execution. Can be one of the following values:
         - inline - show an inline error within the macro but allow the page to continue rendering. Historial Umbraco behaviour.
         - silent - Silently suppress the error and do not render the offending macro.
         - throw  - Throw an exception which can be caught by the global error handler defined in Application_OnError. If no such
                    error handler is defined then you'll see the Yellow Screen Of Death (YSOD) error page.
         Note the error can also be handled by the umbraco.macro.Error event, where you can log/alarm with your own code and change the behaviour per event. -->
    <MacroErrors>throw</MacroErrors>
    
    <!-- These file types will not be allowed to be uploaded via the upload control for media and content -->
    <disallowedUploadFiles>ashx,aspx,ascx,config,cshtml,vbhtml,asmx,air,axd,swf,xml,html.htm,svg,php</disallowedUploadFiles>

    <!-- Defines the default document type property used when adding properties in the back-office (if missing or empty, defaults to Textstring -->
    <defaultDocumentTypeProperty>Textstring</defaultDocumentTypeProperty>
  </content>

  <security>
    <!-- set to true to auto update login interval (and there by disabling the lock screen -->
    <keepUserLoggedIn>true</keepUserLoggedIn>

    <!-- change in 4.8: Disabled users are now showed dimmed and last in the tree. If you prefer not to display them set this to true -->
    <hideDisabledUsersInBackoffice>false</hideDisabledUsersInBackoffice>
    
  </security>

  <requestHandler>
    <!-- this will ensure that urls are unique when running with multiple root nodes -->
    <useDomainPrefixes>false</useDomainPrefixes>
    <!-- this will add a trailing slash (/) to urls when in directory url mode -->
    <addTrailingSlash>true</addTrailingSlash>
    <urlReplacing removeDoubleDashes="true">
      <char org=" ">-</char>
      <char org="&quot;"></char>
      <char org="'"></char>
      <char org="%"></char>
      <char org="."></char>
      <char org=";"></char>
      <char org="/"></char>
      <char org="\"></char>
      <char org=":"></char>
      <char org="#"></char>
      <char org="+">plus</char>
      <char org="*">star</char>
      <char org="&amp;"></char>
      <char org="?"></char>
      <char org="æ">ae</char>
      <char org="ø">oe</char>
      <char org="å">aa</char>
      <char org="ä">ae</char>
      <char org="ö">oe</char>
      <char org="ü">ue</char>
      <char org="ß">ss</char>
      <char org="Ä">ae</char>
      <char org="Ö">oe</char>
      <char org="|">-</char>
      <char org="&lt;"></char>
      <char org="&gt;"></char>
    </urlReplacing>
  </requestHandler>

  <templates>
    <!-- If you want to switch to Mvc then do NOT change useAspNetMasterPages to false -->
    <!-- This (old!) setting is still used to control how macros are inserted into your pages -->
    <useAspNetMasterPages>true</useAspNetMasterPages>

    <!-- To switch the default rendering engine to MVC, change this value from WebForms to Mvc -->
    <!-- Do not set useAspNetMasterPages to false, it is not relevant to MVC usage -->
    <defaultRenderingEngine>Mvc</defaultRenderingEngine>
  </templates>


  <!-- this is used by Umbraco to determine if there's valid classes in the /App_Code folder to be used for Rest/XSLT extensions -->
  <developer>
    <appCodeFileExtensions>
      <ext>cs</ext>
      <ext>vb</ext>
    </appCodeFileExtensions>
  </developer>

  <scripting>
    <razor>
      <!-- razor DynamicNode typecasting detects XML and returns DynamicXml - Root elements that won't convert to DynamicXml -->
      <notDynamicXmlDocumentElements>
        <element>p</element>
        <element>div</element>
        <element>ul</element>
        <element>span</element>
      </notDynamicXmlDocumentElements>
      <dataTypeModelStaticMappings>
        <!--
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping documentTypeAlias="textPage" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" documentTypeAlias="textPage" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" documentTypeAlias="textPage">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping dataTypeGuid="00000000-0000-0000-0000-000000000000" nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            <mapping nodeTypeAlias="propertyAlias">Fully.Qualified.Type.Name.For.ModelBinder,Assembly.Name.Excluding.Dot.Dll</mapping>
            -->
      </dataTypeModelStaticMappings>
    </razor>
  </scripting>

  <!-- This moves the asp.net viewstate data to the end of the html document instead of having it in the beginning-->
  <viewstateMoverModule enable="false" />

  <!-- 
		Now that we have Log4Net logging enabled, this section is only used for what gets logged to the umbracoLog table
		which currently logs items used in the audit trail and roll back scenarios.
		-->
  <logging>
    <enableLogging>true</enableLogging>
    <enableAsyncLogging>true</enableAsyncLogging>
    <disabledLogTypes>
      <!-- <logTypeAlias>[alias-of-log-type-in-lowercase]</logTypeAlias> -->
    </disabledLogTypes>
    <!-- You can add your own logging tool by implementing the umbraco.BusinessLogic.Interfaces.ILog interface and add the reference here -->
    <!-- The external logger can also act as the audit trail storage by setting the logAuditTrail attribute to true -->
    <!--<externalLogger assembly="~/bin/assemblyFileName.dll" type="fully.qualified.namespace.and.type" logAuditTrail="false" /> -->
  </logging>

  <scheduledTasks>
    <!-- add tasks that should be called with an interval (seconds) -->
    <!--    <task log="true" alias="test60" interval="60" url="http://localhost/umbraco/test.aspx"/>-->
  </scheduledTasks>

  <!-- distributed calls must be enabled when using Umbraco in a load balanced environment -->
  <distributedCall enable="false">
    <!-- the id of the user who's making the calls -->
    <!-- needed for security, umbraco will automatically look up correct login and passwords -->
    <user>0</user>

    <!--
    When distributed call is enabled, you need to add all of the servers part taking in load balancing
    to the server list below. 
    -->

    <servers>

      <!-- 
      Add ip number or hostname, make sure that it can be reached from all servers
      you can also add optional attributes to force a protocol or port number.
      
      Examples:
      
      <server>127.0.0.1</server>
      <server forceProtocol="http|https" forcePortnumber="80|443">127.0.0.1</server>
      
      Generally when setting up load balancing you will designate a 'master' server, 
      Umbraco will always assume that the FIRST server listed in this list is the 'master'.
      (NOTE: Not all load balancing scenarios have a 'master', depends on how you are setting it up)
      
      In order for scheduled tasks (including scheduled publishing) to work properly when load balancing, each 
      server in the load balanced environment needs to know if it is the 'master'. In order for servers
      to know this or not, they need to compare some values against the servers listed. These values
      are either: serverName or appId. You should not enter both values but appId will always supersede serverName.
      The serverName is the easiest and will work so long as you are not load balancing your site on the same server.
      If you are doing this, then you will need to use appId which is equivalent to the value returned from
      HttpRuntime.AppDomainAppId. It is recommended that you set either the serverName or appId for all servers 
      registered here if possible, not just the first one.
      
      Examples:
      
      <server serverName="MyServer">server1.mysite.com</server>      
      <server appId="/LM/W3SVC/69/ROOT">server1.mysite.com</server>      
      -->
     
      
    </servers>
  </distributedCall>

  <!-- Configuration for repositories -->
  <!-- Add or remove repositories here. You will need the repository's unique key to be able to connect to it.-->
  <repositories>
    <repository name="Umbraco package Repository" guid="65194810-1f85-11dd-bd0b-0800200c9a66" />
  </repositories>

  <providers>
    <users>
      <!-- if you wish to use your own membershipprovider for authenticating to the umbraco back office -->
      <!-- specify it here (remember to add it to the web.config as well) -->
      <DefaultBackofficeProvider>UsersMembershipProvider</DefaultBackofficeProvider>
    </users>
  </providers>

  <!-- Maps language, usertype, application and application_url to help pages -->
  <help defaultUrl="http://our.umbraco.org/wiki/umbraco-help/{0}/{1}">
    <!-- Add links that should open custom help pages -->
    <!--<link application="content" applicationUrl="dashboard.aspx"  language="en" userType="Administrators" helpUrl="http://www.xyz.no?{0}/{1}/{2}/{3}" /> -->
  </help>

  <!-- 
    web.routing
      @trySkipIisCustomErrors
        Tries to skip IIS custom errors.
        Starting with IIS 7.5, this must be set to true for Umbraco 404 pages to show. Else, IIS will take
        over and render its build-in error page. See MS doc for HttpResponseBase.TrySkipIisCustomErrors.
        The default value is false, for backward compatibility reasons, which means that IIS _will_ take
        over, and _prevent_ Umbraco 404 pages to show.
      @internalRedirectPreservesTemplate
        By default as soon as we're not displaying the initial document, we reset the template set by the
        finder or by the alt. template. Set this option to true to preserve the template set by the finder
        or by the alt. template, in case of an internal redirect.
        (false by default, and in fact should remain false unless you know what you're doing)
  -->
  <web.routing
    trySkipIisCustomErrors="false"
    internalRedirectPreservesTemplate="false">
  </web.routing>

</settings>