Fixes 10730 - Route hijacking with public access

[Shazwazza]

Fixes #10730 - Route hijacking with public access

The reason why it doesn't work is because DynamicRouteValueTransformer is responsible for assigning the controller/action tokens. ASP.NET then uses it's response to map to an endpoint (controller/action). Our public access middleware executes after the transformer and re-assigns our own UmbracoRouteValues so that the correct page is rendered, but this doesn't affect the results returned from our transformer - which is why the original endpoint is selected.

The endpoint selection is stored in the HttpContext as a feature: IEndpointFeature. It may be possible to replace this before endpoint is executed within the middleware but this is against best practices (undocumented) and will probably result in some caching not being done behind the scenes in aspnet.

The only real way to deal with this is going to be to move the public access code directly up into the original routing pipeline and not use middleware so that we can return the correct route values from within our route transformer so aspnet selects the correct endpoint from that data.

• Changes PublicAccessMiddleware to IPublicAccessRequestHandler and puts the logic for this directly inside of the transformer
• The IPublicAccessRequestHandler no longer sets the httpfeature for UmbracoRouteValues, it just returns new ones or the original ones
• The transformer logic rearranged a bit:
  • We were checking for posted values even if there was no content matched, so the no content check was moved above
  • We check public access before checking posted values - since this would have also occurred with the old middleware solution

Testing

• Follow the repro steps in Route hijacking with restricted public access - protected page request is not handled by custom login page controller #10730 and make sure it works
• Make sure that a surface controller POST form still works as expected

[bergmania]

I can confirm this fixes #10730 and surface controllers do still work as expected.. Code changes also makes good sense, with this description :)

Amazing work - as always 💪