i had written code using server side object model for adding user custom actions to the site action..now my question is how to give permission levels to that action because every one see custom actions create when it is added in site action menu.i have to restrict using user custom actions from site action.How can i do this using server object model.
The customAction tag in Element.xml file has Rights attribute you can use that to give permissions
<CustomAction Rights = "Text"> </CustomAction>
Rights: Optional Text. Specifies a set of rights that the user must have for the link to be visible, for example, "ViewListItems,ManageAlerts". If it is not specified, the action always appears in the list of actions. To specify multiple rights, separate the values by using commas. The set of rights are grouped logically according to AND logic, which means that a user must have all the specified rights to see an action. For a list of possible values, see Microsoft.SharePoint.SPBasePermissions.
Related
I am trying to set up some restrictions within my Sitecore instance so that users who only have permission to create items within a subsection of a site also have the publish permission, but only have the ability to publish items where they have create content permission.
For example I have the content similar to the following:
Sitecore
|- Content
|- Home
| - WhatWeDo
| - Infrastructure
| - Training
| - Locations
| - Europe
| - North America
I have set up the Everyone role to have read permission to all items within the content tree, and I have specifically specified that they are denied write, rename, create, and delete permission
I have set up a role, "WhatWeDo" and has been granted write, rename, create, and delete permission to item WhatWeDo and its descendants.
Now if I add the "WhatWeDo" role to the Client Publishing role, then the users who have been granted "WhatWeDo" role, also have the ability to publish, but they have the ability to publish any item within the content tree. i.e. The Publish button on the Publish ribbon is displayed.
Mostly when I have tried googling this, they are talking about publishing restrictions. i.e the Publishing Settings dialog, but this is of no use to me in this scenario.
I have found this https://stackoverflow.com/a/6351649/1442308 but I cannot seem to get this working and I suspect that it is related to very old version of Sitecore and no longer applies.
I have also updated my config so that the publishing should only publish if have read and write permission
<setting name="Publishing.CheckSecurity" >
<patch:attribute name="value" value="true" />
</setting>
But this has had no effect on restricting users publishing content tree items that they should not as the user is still able to publish items within the Locations section of the content tree. i.e. The publish button is still visible on the Publish ribbon.
I need to restrict this so that those users who have been granted the "WhatWeDo" role can only publish item WhatWeDo and its descendants, and do not have the ability to publish any other item within the content tree. i.e They should only have the publish button visible when they are in the WhatWeDo item or any of its descendants.
Update
Updated question to make it clearer that I want to make sure that the publishing button is not visible on the ribbon bar.
The Publishing.CheckSecurity setting is used durring the execution of the publish, so only items that the user has access to are actually published. It does not affect access to the publish ribbon button.
Typically, people use workflow to achieve what you are looking for. Set up a workflow with a publish action. The sample workflow provided with the initial install gives an example of this. Then you can restrict access to the workflow command.
Update
The Sample Workflow that is provided out-of-the-box has everything you need to get this to work. It has the commands and the auto-publish action as well as the security settings applied for the Sitecore Client Authoring role.
Since you have already applied security to your content items, all you would need to do is assign those items to the sample workflow. You could duplicate it and rename it if you wanted. You could also rename the Approve command to Publish.
To ensure that the standard publish button does not appear in the ribbon, make sure that these users are not members of the Sitecore Client Publishing role.
(Sorry but I don't have the comments option enabled yet.)
I would definitely go for the workflows option. As mentionned in the comments, the Publish button will be enabled through the security permissions, but as a general ability, not dependent on the items permissions. If you don't want the Publish button to show up without going into fancy customizations, you should forget this option.
Instead of the classical Publish button, users would have the workflow button triggering the publish action, under the Review tab. It wouldn't change that much for your end-users. It will even get them used to the workflow actions, that you could further use and refine, later in your project. You could take this opportunity to introduce them in your project, moreover it's perfectly suiting your needs.
Don't hesitate to ask if you want more detailed explanations on how to set up such a workflow.
It's not possible hide the publish button in the ribbon out of the box for items that the user does not have access to, but it is quite simple to use the Rules Engine to control whether the button is shown or not. It will require some coding though, there is no way around that.
You can find more information in these blog posts, but there are some differences for Sitecore 7.1+ due to changes in the Rules Engine:
Rule-Based User Interface Components for the Sitecore Client
How to create a custom ribbon in Sitecore Content Editor
Limiting Conditions and Actions with Sitecore 7.1+
1. Create the rule action class
In your Visual Studio Project create the CommandRuleContext and SetCommandState classes as specified in first blog post.
2. Create the Rule in Sitecore
This is where there have been a lot of updates in Sitecore 7.1+, the third blog post explains the new structure of the rules engine:
Under /sitecore/system/Settings/Rules/Definitions/Tags create a new tag called Command State
Under /sitecore/system/Settings/Rules/Definitions create a new folder called Command States and add the 4 states shown in Step 1.14
Create a new Element Folder under /sitecore/system/Settings/Rules/Definitions/Elements called Command Rules
Insert a new Action under this folder. Set the field values as:
Text: set command state to [commandstateid,Tree,root=/sitecore/system/Settings/Rules/Definitions/Command States,specific command state]
Type: MyProject.Custom.Commands.SetCommandState, MyProject.Custom
Select the Tags/Default item and select Command State from the list of tags. This is the tag we defined earlier.
Now under /sitecore/system/Settings/Rules insert a new "Rules Context Folder" called Command Rules and then add a new rule in the Rules folder.
Before we create the rule we need to associate tags to show the conditions and actions. Select the "Tags/Default" item again and this time select Command State and Item Security. You can select different tags if you want to use different conditions (e.g. Item Hierarchy, Item Information, Security etc)
Now create the rule with condition you need, e.g.
3. Update the command to use the Rules
We need to update the code for the Publish button command to use the Rules we have defined.
Create a new command class inheriting from the existing Publish command:
using Sitecore.Data.Items;
using Sitecore.Diagnostics;
using Sitecore.Rules;
using Sitecore.SecurityModel;
using Sitecore.Shell.Framework.Commands;
namespace MyProject.Custom.Commands
{
public class PermissionBasedPublish : Sitecore.Shell.Framework.Commands.PublishNow
{
public override CommandState QueryState(CommandContext context)
{
Assert.ArgumentNotNull(context, "context");
var state = base.QueryState(context);
if (state != CommandState.Enabled)
return state;
return RunRules(context);
}
private CommandState RunRules(CommandContext context)
{
Item parentRuleItem;
var ruleContext = new CommandRuleContext();
ruleContext.Item = context.Items[0];
using (new SecurityDisabler())
{
parentRuleItem = ruleContext.Item.Database.GetItem("/sitecore/system/Settings/Rules/Command Rules/Rules");
if (parentRuleItem == null)
return CommandState.Enabled;
}
RuleList<CommandRuleContext> rules = RuleFactory.GetRules<CommandRuleContext>(parentRuleItem, "Rule");
if (rules == null)
return CommandState.Enabled;
rules.Run(ruleContext);
return ruleContext.CommandState;
}
}
}
And now we can patch in this command instead of the default one:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
<sitecore>
<commands>
<command name="item:publishnow">
<patch:attribute name="type">MyProject.Custom.Commands.PermissionBasedPublish, MyProject.Custom</patch:attribute>
</command>
</commands>
</sitecore>
</configuration>
The visibility of the publish button is now based on defined rules. With the rule defined above, the button will only be visible if the user has write access to the current item they are one.
The user will still need publish permission using the appropriate roles. Note that using out of the box roles means the user will have access to the Publish Site option from the drop down as well. You need to restrict access to /sitecore/content/Applications/Content Editor/Menues/Publish/Publish Site in the Core database and the shortcut from the desktop as appropriate.
You may also want to combine this with the Publishing.CheckSecurity setting by setting it to true.
I'll add that giving users Publish rights as a general rule is a bad idea IMO since every publish, even of a single item (and this includes Auto-Publish with Workflow) will clear the HTML caches and may lead to performance issues.
I have a project where I need a member group called Staff Admin (slightly less privileges than Super Admin) to be able to public entry data on behalf of a site Member via a Safecracker form. Now I am able to successfully set an 'author_id' on the form (using a hidden input) and a user logged in under the Super Admin group can successfully publish the new entry and have the specified author_id set on the entry.
The problem is that even though I have the 'Staff Admin' group settings allow to edit and change authors on entries, I'm unable to do it on a Safecracker form and the specified 'author_id' is ignored and I'm getting an error triggered for 'invalid_author' (The selected author is invalid.)
Think the line in the Api_channel_entries.php is around 1246 (under EE 2.4) where it’s looking to authenticate against Super Admin group only as the exception:
if ($data['author_id'] != $this->EE->session->userdata('member_id') && $this->EE->session->userdata('group_id') != 1)
Any ideas how I might circumvent this problem I have?
That error is being triggered because the author ID that you're trying to reassign the entry to is not one of the designated valid authors for the channel. To fix this you'll need to edit the member group (of the user you're trying to assign the entry to) and enable the 'Include Members in PUBLISH page multi-author list?' setting.
You may also need to enable that setting for each individual user via Member Administration > Edit Member > Member Preferences > "Include user in PUBLISH page multi-author list?"
Suppose there's a top-secret list (inherits its permissions from its parent) that contains records that were created earlier by different users. There are several groups with rights to administer, read, write-constrainted.
There is a group of authors of top-secret items. Author can only create a 'secret-item'. But the item shouldn't be viewed by other participants of the group (Authors).
I can't access/change site programmatically. And I'm curious how come I do this manually.
First, keep in mind that you cannot do "top-secret" in SharePoint. The site collection administrator will always have access to all content.
Manually, there are two features that come close to your request:
under advanced options in the list settings: user can only read/write his/her own items
under the same advanced options: activate approval. Content in draft state will remain hidden (except from approvers and site owners)
In addition to the answers from #Christophe, you can also modify the permissions of individual List Items.
If you were able to make programmatic changes, I would suggest attaching an ItemAdded event receiver to a custom Content Type named "Top Secret." But in this case, the permissions changes can be made as a manual step after adding the item.
The risk, of course, is if the author forgets to change the permissions, changes the permissions incorrectly, or changes the permissions very slowly (allowing others to see it before permissions are changed).
For more information on changing the permissions of a List Item, see Break permission inheritance on a folder, document, or list item.
we created one page and placed under LAYOUTS folder.so can u tell me can all users access this page by giving their AD credentials.
some users are not able to login to this page.
pleage give me some suggestions.
The default Application Page setup will require the View Application Pages permission, and all derived permissions. You can manually configure the permissions of the application page by defining the RightsRequired property of the page. This is usually defined OnLoadComplete, but you can specify to occur after OnPreInitComplete by configuring the RightsCheckMode property.
But, without fiddling in these settings, it is still possible that certain users who have the read permissions on the general site may be barred from the Application Page. This can arise whenever you have controls that require different permission levels. For example, if you have a custom application page that has a field control associated with a specific list and item, if that control is in Edit mode then the user needs Edit permissions for that list and item in order to view the application page. It does not actually matter if this field control has anything to do with the list in question! For example, I once had an application page designed for bulk-downloading files which are in two folders. I wanted to re-use this page for a few different document libraries, so I decided to create a custom multi-lookup field control that would take the List query string as if on a New Form, and build the list of items to download that way. But this page was blocked for a subset of users who were not allowed New item permissions in one of the two folders, even though the page technically didn't do anything involving adding new items.
Any other elements on the page which require a separate set of permissions than general site permissions will also interfere, but the general case is with item-level and list-level permissions conflicting with the site-level permission. Simply check all of your controls, especially ones based on SharePoint web controls. As long as the user has permissions necessary to operate all of these, the user should be able to view the application page.
The entire user who has read permission, they can access this page.
If this page trying to do any manipulation, which needs hire permission, you may get access denied.
For trouble shooting comment all cods and try to access this page with read permission.
I have a project where I need to add users to a SharePoint portal, but when I add them, I also need to set addition parameters inside a separate database.
I want to add a custom administration screen where the administration can set these values when they add the user rather than forcing them to first add the user then go to a separate interface page where they set the values.
Does anyone know of any good articles that will explain how to accomplish this?
Thanks.
It would be easier to create a custom asp.net form that would get all the information required about the user.
the submit could then add the information to the database that is needed and use the object model to add the users.
SPRoleAssignment MyRoleAssign = new SPRoleAssignment(”domain/alias”, “email address”, “User Name”, “Description”);
SPRoleDefinition MyRoleDef = newSubWeb.RoleDefinitions["Contribute"];
MyRoleAssign.RoleDefinitionBindings.Add(MyRoleDef);
site.RoleAssignments.Add(MyRoleAssign);
Code from farhanfaiz.wordpress.com here
Otherwise the SharePoint webservices may do.
Examples here