eric
-
11/19/2005 11:00:17 AM
CMSEditableRegion has no CheckPermissionsForUserID property
I wonder why there is no CheckPermisionsForUserID property in the CMSEdiableRegion control.
I have now some code-behind (that seems to work) but I assume that more developers need to develop this code all the same and therefore subject property would be an improvement.
I am afraid I may overlook something. Therefore here is some explanation.
A secured web site with user roles EMPloyee and MGR. MGR may see all pages. EMP may see a subset of pages. Pages are built with the CMSEditableRegion control. Anonymous users have no access.
Normally user access is controlled with the CMSPageManager control and therefore EMP has no visibility of the MGR menu's and subsequently no access to the MGR pages. However the EMPloyee has received a shortcut to a MGR page and bypasses the menus.
I had to develop the following code to prevent this (event Page Load of the MGR page): 'Test if user is authenticated. Dim userID As Integer = Functions.GetUserID If userID = 0 Then 'user is not authenticated, do nothing; Else 'User is authenticated, now test if the user is authorized; he may arrive here with a shortcut and has bypassed the menu access If Functions.IsAuthorizedPerNode("/Management", Kentico.CMS.TreeEngine.TreePathTypeEnum.AliasPath, Kentico.CMS.TreeEngine.NodePermissionsEnum.Read) = True Then SignOutButton1.Visible = User.Identity.IsAuthenticated CMSTreeMenu1.CheckPermissionsForUserID = Functions.GetUserID lblUserId.Text = User.Identity.Name Else 'user is authenticated but not authorized, then redirect him to the error page. Functions.RedirectToAccessDenied("Manager", "Read") End If End If Not sure if this the best code but it would be more more efficient to move this logic to the CMSEditableRegion control, in my mind. It would be consistent with all the other controls that have the CheckPermissionsForUserID property.
Your comment is appreciated. -Eric
|