Workflows in SharePoint werken niet meer na update van Windows (vervolg)

Vervolg van het bericht ‘Workflows in SharePoint werken niet meer na update van Windows‘:

<#

 This script will add the entries to all web.config files for all web applications in the farm.

 Run this script as Farm Administrator in one of the WFEs.

 This script only needs to run one time.

SUMMARY:

This script leverages the native SharePoint SPWebConfigModification API to deploy new updates to the web.config file for each web application on each server in the farm.  Servers added a later date will also get the updates applied because the API configuration is persisted in the config database.  This API does not update the web.config for the central administration web application.

If you are running workflows on the central admin web application, you will need to manually update the web.config using the steps in the referenced blog.

==============================================================

#>

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue | Out-Null

function Add-CodeDomAuthorizedType

{

    <#

    .Synopsis

       Adds the necessary authorizedType elements to all web.config files for all non-central admin web applications

    .DESCRIPTION

       Adds the necessary authorizedType elements to all web.config files for all non-central admin web applications

    .EXAMPLE

       Add-CodeDomAuthorizedType

    #>

    [CmdletBinding()]

    param

    (

    )

    begin

    {

        $farmMajorVersion = (Get-SPFarm -Verbose:$false ).BuildVersion.Major

        $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService

        $typeNames = @( "CodeBinaryOperatorExpression", "CodePrimitiveExpression", "CodeMethodInvokeExpression", "CodeMethodReferenceExpression", "CodeFieldReferenceExpression","CodeThisReferenceExpression", "CodePropertyReferenceExpression")

   

    }

    process

    {

        if( @($contentService.WebConfigModifications | ? { $_.Name -eq "NetFrameworkAuthorizedTypeUpdate" }).Count -gt 0 )

        {

            Write-Warning "Existing NetFrameworkAuthorizedTypeUpdate entries found, this script only need to be run once per farm."

            return

        }

        if( $farmMajorVersion -le 14 ) # 2010, 2007

        {

            foreach( $typeName in $typeNames )

            {

                # System, Version=2.0.0.0

                $netFrameworkConfig = New-Object Microsoft.SharePoint.Administration.SPWebConfigModification

                $netFrameworkConfig.Path     = "configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes"

                $netFrameworkConfig.Name     = "authorizedType[@Assembly='System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'][@Namespace='System.CodeDom'][@TypeName='{0}'][@Authorized='True']" -f $typeName

                $netFrameworkConfig.Owner    = "NetFrameworkAuthorizedTypeUpdate"

                $netFrameworkConfig.Sequence = 0

                $netFrameworkConfig.Type     = [Microsoft.SharePoint.Administration.SPWebConfigModification+SPWebConfigModificationType]::EnsureChildNode

                $netFrameworkConfig.Value    = '<authorizedType Assembly="System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Namespace="System.CodeDom" TypeName="{0}" Authorized="True"/>' -f $typeName

           

                $contentService.WebConfigModifications.Add($netFrameworkConfig);

            }

        }

        else # 2013+

        {

            foreach( $typeName in $typeNames )

            {

                # System, Version=4.0.0.0

                $netFrameworkConfig = New-Object Microsoft.SharePoint.Administration.SPWebConfigModification

                $netFrameworkConfig.Path     = "configuration/System.Workflow.ComponentModel.WorkflowCompiler/authorizedTypes/targetFx"

                $netFrameworkConfig.Name     = "authorizedType[@Assembly='System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'][@Namespace='System.CodeDom'][@TypeName='{0}'][@Authorized='True']" -f $typeName

                $netFrameworkConfig.Owner    = "NetFrameworkAuthorizedTypeUpdate"

                $netFrameworkConfig.Sequence = 0

                $netFrameworkConfig.Type     = [Microsoft.SharePoint.Administration.SPWebConfigModification+SPWebConfigModificationType]::EnsureChildNode

                $netFrameworkConfig.Value    = '<authorizedType Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Namespace="System.CodeDom" TypeName="{0}" Authorized="True"/>' -f $typeName

           

                $contentService.WebConfigModifications.Add($netFrameworkConfig);

            }

        }

        Write-Verbose "Updating web.configs"

        $contentService.Update()

        $contentService.ApplyWebConfigModifications();

    }

    end

    {

    }   

}

function Remove-CodeDomAuthorizedType

{

    <#

    .Synopsis

       Removes any web configuration entires owned by "NetFrameworkAuthorizedTypeUpdate"

    .DESCRIPTION

       Removes any web configuration entires owned by "NetFrameworkAuthorizedTypeUpdate"

    .EXAMPLE

        Remove-CodeDomAuthorizedType

    #>

    [CmdletBinding()]

    param()

    begin

    {

        $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService

    }

    process

    {

        $webConfigModifications = @($contentService.WebConfigModifications | ? { $_.Owner -eq "NetFrameworkAuthorizedTypeUpdate" })

        foreach ( $webConfigModification in $webConfigModifications )

        {

            Write-Verbose "Found instance owned by NetFrameworkAuthorizedTypeUpdate"

            $contentService.WebConfigModifications.Remove( $webConfigModification ) | Out-Null

        }

        

        if( $webConfigModifications.Count -gt 0 )

        {

            $contentService.Update()

            $contentService.ApplyWebConfigModifications()

        }

    }

    end

    {

    }   

}

# will get the timerjob responsible for the web.config change deployment

# Get-SPTimerJob | ? { $_.Name -eq "job-webconfig-modification" }

 

# The command below will make the appropriate changes

Add-CodeDomAuthorizedType

# remove # below if you need to remove the web.config updates, you can with this function to retract the changes

# Remove-CodeDomAuthorizedType

Meer info:
https://support.microsoft.com/en-us/help/4465015/sharepoint-workflows-stop-after-cve-2018-8421-security-update