﻿<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
    <sectionGroup name="jayrock">
      <sectionGroup name="jsonrpc">
        <section name="features" type="Jayrock.JsonRpc.Web.JsonRpcFeaturesSectionHandler, Jayrock" />
      </sectionGroup>
    </sectionGroup>
  </configSections>
  <jayrock>
    <jsonrpc>
      <features>
        <add name="rpc" type="Jayrock.JsonRpc.Web.JsonRpcExecutive, Jayrock" />
        <add name="getrpc" type="Jayrock.JsonRpc.Web.JsonRpcGetProtocol, Jayrock" />
        <add name="proxy" type="Jayrock.JsonRpc.Web.JsonRpcProxyGenerator, Jayrock" />
        <add name="directapi" type="Veeam.Backup.WebApp.CProxyGenerator, Veeam.Backup.WebApp" />
      </features>
    </jsonrpc>
  </jayrock>
  <appSettings>
    <add key="BES-host" value="127.0.0.1" />
    <add key="BES-port" value="888" />
    <add key="cacheTimeout" value="30" />
    <add key="sessionTimeout" value="30" />
    <add key="requestTimeout" value="900" />
    <add key="appVersion" value="9.5.4.0" />
    <add key="logFileName" value="Veeam.WebApp.log" />
    <add key="loginAttemtNumber" value="10" />
    <add key="loginLockTimeoutMinutes" value="10" />
    <add key="vs:EnableBrowserLink" value="false" />
    <add key="title" value="Veeam Backup Enterprise Manager" />
    <add key="vsphere_title" value="Self-Service Backup Portal" />
    <add key="vcloud_title" value="Self-Service Backup Portal" />
    <add key="useWindowsAuth" value="true" />
  </appSettings>
  <!--
    For a description of web.config changes see http://go.microsoft.com/fwlink/?LinkId=235367.

    The following attributes can be set on the <httpRuntime> tag.
      <system.Web>
        <httpRuntime targetFramework="4.5.2" />
      </system.Web>
  -->
  <system.web>
    <compilation targetFramework="4.5.2">
      <assemblies>
        <add assembly="System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Runtime.Serialization.Formatters.Soap, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="Microsoft.VisualC, Version=10.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
      </assemblies>
    </compilation>
    <authentication mode="Forms">
      <forms name=".ASPXAUTH" defaultUrl="~/Default.aspx" enableCrossAppRedirects="true" loginUrl="/Security/Windows/WinLogin.aspx" path="/" protection="All" timeout="2880" />
    </authentication>

    <identity impersonate="false" />
    <sessionState mode="Off" />
    <globalization enableClientBasedCulture="true" culture="auto:en-us" uiCulture="auto:en-us" />
    <machineKey decryption="3DES" decryptionKey="50E59EF4A5DD3B9DD94F8FEB537FE5F7032876EAFA7D5EEC" validation="HMACSHA256" validationKey="E7E47AC4D4E97F0DBEDE831A16B6C0AACC979EE70C21DD304E0B9B865934EA1241D95195D3DD9FD7877F87C28B1921E8E9ECB140A9BF72F6B26007ECF56710D9" />
    <pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID" />
    <httpRuntime requestValidationMode="2.0" targetFramework="4.5" executionTimeout="300" enableVersionHeader="false" />
    <httpModules>
      <add name="MixedAuthenticationModule2" type="Veeam.Backup.WebApp.MixedAuthenticationModule2" />
    </httpModules>
  </system.web>
  <system.webServer>
    
    <security>
      <authentication>
        <windowsAuthentication enabled="false" />
        <anonymousAuthentication enabled="true" />
      </authentication>
    </security>
    <httpErrors existingResponse="Replace" errorMode="Custom">
      <remove statusCode="404" />
      <remove statusCode="500" />
      <error statusCode="404" prefixLanguageFilePath="" path="/Errors/404.aspx" responseMode="ExecuteURL" />
      <error statusCode="500" prefixLanguageFilePath="" path="/Errors/500.aspx" responseMode="ExecuteURL" />
    </httpErrors>
    <validation validateIntegratedModeConfiguration="false" />
    <modules>
      <remove name="FormsAuthenticationModule" />
      <add name="MixedAuthenticationModule2" type="Veeam.Backup.WebApp.MixedAuthenticationModule2" preCondition="managedHandler" />
    </modules>
    <staticContent>
      <remove fileExtension=".svg" />
      <remove fileExtension=".svgz" />
      <remove fileExtension=".woff" />
      <remove fileExtension=".ttf" />
      <remove fileExtension=".otf" />
      <remove fileExtension=".eot" />
      <remove fileExtension=".json" />
      <mimeMap fileExtension=".svg" mimeType="image/svg+xml" />
      <mimeMap fileExtension=".svgz" mimeType="image/svg+xml" />
      <mimeMap fileExtension=".woff" mimeType="application/x-font-woff" />
      <mimeMap fileExtension=".ttf" mimeType="application/x-font-truetype" />
      <mimeMap fileExtension=".otf" mimeType="application/x-font-opentype" />
      <mimeMap fileExtension=".eot" mimeType="application/vnd.ms-fontobject" />
      <mimeMap fileExtension=".json" mimeType="application/json" />
    </staticContent>
    <rewrite>
      <rules>
        <rule name="Redirect to https" enabled="true" stopProcessing="true">
          <match url="(.*)" ignoreCase="true" />
          <serverVariables>
            <set name="APP_HTTPS_PORT" value="9443" />
          </serverVariables>
          <conditions logicalGrouping="MatchAll" trackAllCaptures="true">
            <add input="{HTTPS}" pattern="off" />
            <add input="{HTTP_HOST}" pattern="([^/:]*?)(\:[^/]*?)?$" />
          </conditions>
          <action type="Redirect" url="https://{C:1}:{APP_HTTPS_PORT}/{R:0}" appendQueryString="false" />
        </rule>
        <!-- SelfService redirect -->
        <rule name="SelfRestore" enabled="true" stopProcessing="true">
          <match url="^selfRestore" />
          <action type="Redirect" redirectType="Permanent" url="/index.aspx?selfrestore=true" logRewrittenUrl="true" />
        </rule>
         <!-- VCloud redirects -->
        <rule name="vCloud signalR" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/signalr/([a-z]+)" />
          <action type="Rewrite" url="/signalr/{R:2}?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="Default Document">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/?$" />
          <action type="Redirect" url="/vCloud/{R:1}/Index.aspx" redirectType="Permanent" />
        </rule>
  
        <rule name="vCloudNew" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Index.aspx" />
          <action type="Rewrite" url="vCloud/Index.aspx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="Login" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Login.aspx" />
          <action type="Rewrite" url="vCloud/Login.aspx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="Error" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Error.aspx" />
          <action type="Rewrite" url="vCloud/Error.aspx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="ExportExcel" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/ExportExcel.aspx" />
          <action type="Rewrite" url="/ExportExcel.aspx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="ZipDownload" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/ZipDownload.ashx" />
          <action type="Rewrite" url="/ZipDownload.ashx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="Rpc" stopProcessing="true">
          <match url="^vCloud/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/CommonDataHandler.ashx" />
          <action type="Rewrite" url="/CommonDataHandler.ashx?org={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="RequestBlockingRule1" patternSyntax="Wildcard" stopProcessing="true">
          <match url="/vCloud/Default.aspx" />
          <conditions />
          <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
        </rule>
        <rule name="RequestBlockingRule2" patternSyntax="Wildcard" stopProcessing="true">
          <match url="/vCloud/Configuration.aspx" />
          <conditions />
          <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
        </rule>
        <!-- VSphere redirects -->
        <rule name="VSphere default page">
          <match url="^backup/([A-Za-z0-9\-]+)/$" />
          <action type="Redirect" url="/backup/{R:1}/Index.aspx" appendQueryString="false" />
        </rule>

        <rule name="VSphere signalR" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/signalr/([a-z]+)" />
          <action type="Rewrite" url="/signalr/{R:2}?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>

        <rule name="VSphere new main page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Index.aspx" />
          <action type="Rewrite" url="backup/Index.aspx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere login page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Login.aspx" />
          <action type="Rewrite" url="backup/Login.aspx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere error page" stopProcessing="true">
          <match url="^backup/Error.aspx" />
          <action type="Rewrite" url="backup/Error.aspx" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere account error page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/Error.aspx" />
          <action type="Rewrite" url="backup/Error.aspx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere excel export page" stopProcessing="true">
          <match url="^backup/ExportExcel.aspx" />
          <action type="Rewrite" url="/ExportExcel.aspx" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere account excel export page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/ExportExcel.aspx" />
          <action type="Rewrite" url="/ExportExcel.aspx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere zip download page" stopProcessing="true">
          <match url="^backup/ZipDownload.ashx" />
          <action type="Rewrite" url="/ZipDownload.ashx" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere account zip download page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/ZipDownload.ashx" />
          <action type="Rewrite" url="/ZipDownload.ashx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere common data handler page" stopProcessing="true">
          <match url="^backup/CommonDataHandler.ashx" />
          <action type="Rewrite" url="/CommonDataHandler.ashx" logRewrittenUrl="true" />
        </rule>
        <rule name="VSphere account common data handler page" stopProcessing="true">
          <match url="^backup/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/CommonDataHandler.ashx" />
          <action type="Rewrite" url="/CommonDataHandler.ashx?vc_acc={R:1}" logRewrittenUrl="true" />
        </rule>
      </rules>

      <outboundRules>
        <rule name="Update Url property" preCondition="JSON" enabled="true" stopProcessing="true">
          <match filterByTags="None" pattern="\&quot;Url\&quot;:\&quot;(.+?)\&quot;" />
          <conditions logicalGrouping="MatchAny">
            <add input="{CACHE_URL}" pattern="(backup|vCloud)/([A-Za-z0-9_\!\$\(\)\'\.\,\-]+)/signalr" />

          </conditions>
          <action type="Rewrite" value="&quot;Url&quot;:&quot;/{C:1}/{C:2}{R:1}&quot;" />
        </rule>
        <rule name="Remove Server header">
          <match serverVariable="RESPONSE_Server" pattern=".+" />
          <action type="Rewrite" value="" />
        </rule>
        <preConditions>
          <preCondition name="JSON">
            <add input="{URL}" pattern="/signalr/negotiate" />
            <add input="{RESPONSE_CONTENT_TYPE}" pattern="^application/json" />
          </preCondition>
        </preConditions>
      </outboundRules>
    </rewrite>

    <httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <add name="X-XSS-Protection" value="1; mode=block" />
        <add name="Strict-Transport-Security" value="max-age=31536000" />
        <add name="X-Content-Type-Options" value="nosniff" />
        <remove name="X-Powered-By" />
        <remove name="X-AspNet-Version" />
      </customHeaders>
    </httpProtocol>

    <defaultDocument enabled="true">
      <files>
        <clear />
        <add value="Index.aspx" />
      </files>
    </defaultDocument>

  </system.webServer>
  <location path="ZipDownload.ashx">
    <system.web>
      <httpRuntime executionTimeout="600" />
    </system.web>
  </location>
</configuration>