Don't miss out Virtual Happy Hour this Friday (April 26).

Try our conversational search powered by Generative AI!

eGandalf
Oct 11, 2016
  5242
(3 votes)

Quick & Dirty Check for Role Permissions on IContent

For some reason, this was not an easy one to find, since most articles focus only on the current user and not using the Episerver APIs for lookups against other users or roles. Though I find it a bit strange, a customer needs to display a list of documents and indicate which among those documents are publicly accessible versus private (members-only). 

Thanks to David Knipe, my Twitter-based weathervane, I came up with a relatively quick and simple set of static methds for doing just that. Providing them here for posterity, allowing you to check a given role for a given permission via a quick extension whenever and wherever you need it.

public static Boolean IsAvailableToEveryone(this T content) where T : IContent
{
    return content.RoleHasAccess(new[] { "Everyone" }, AccessLevel.Read);
}

public static Boolean RoleHasAccess(this T content, string[] roles, AccessLevel accessLevel) where T : IContent
{
    var securedContent = content as ISecurable;
    var descriptor = securedContent.GetSecurityDescriptor();
    var identity = new GenericIdentity("doesn't matter");
    var principal = new GenericPrincipal(identity, roles);
    return descriptor.HasAccess(principal, accessLevel);
}
Oct 11, 2016

Comments

Oct 11, 2016 07:13 PM

Hi,

The last method can't be working. accessLevel.HasFlag(accessLevel) is always true.

eGandalf
eGandalf Oct 11, 2016 07:54 PM

Thanks - idiot copy/paste on my part. Fixed the return. Had it right and then rewrote it poorly.

henriknystrom
henriknystrom Oct 11, 2016 11:13 PM

Good stuff James,

Just want to clarify one thing about this snippet. This code will only check that a role has access to the content according to it's assigned access rights. It won't take into consideration the published state or if the content has been deleted. To get this functionality you can use the IContentAccessEvaluator service.

eGandalf
eGandalf Oct 11, 2016 11:23 PM

Good point, Henrik. However, from what I can tell the IContentAccessEvaluator is an Episerver internal API, not one really intended for our consumption, so I'd prefer to not recommend it.

Seems easy enough to add a check for IsDeleted, though if it's truly generic and I'm not sure whether the content is a Page, Block, Media or other type of IContent, the published status doesn't seem as obvious to check.

eGandalf
eGandalf Oct 11, 2016 11:29 PM

I think I could add these two validators, since PageData has that convenient CheckPublishedStatus, but it still wouldn't cover Blocks or Media.

if (content.IsDeleted) return false;

if(content is PageData)

{

    if (!(content as PageData).CheckPublishedStatus(PagePublishedStatus.Published))

        return false;

}

Please login to comment.
Latest blogs
Solving the mystery of high memory usage

Sometimes, my work is easy, the problem could be resolved with one look (when I’m lucky enough to look at where it needs to be looked, just like th...

Quan Mai | Apr 22, 2024 | Syndicated blog

Search & Navigation reporting improvements

From version 16.1.0 there are some updates on the statistics pages: Add pagination to search phrase list Allows choosing a custom date range to get...

Phong | Apr 22, 2024

Optimizely and the never-ending story of the missing globe!

I've worked with Optimizely CMS for 14 years, and there are two things I'm obsessed with: Link validation and the globe that keeps disappearing on...

Tomas Hensrud Gulla | Apr 18, 2024 | Syndicated blog

Visitor Groups Usage Report For Optimizely CMS 12

This add-on offers detailed information on how visitor groups are used and how effective they are within Optimizely CMS. Editors can monitor and...

Adnan Zameer | Apr 18, 2024 | Syndicated blog