This project is read-only.

Why does creating an item check for PublishContent permission?

Topics: Customizing Orchard
Jun 1, 2011 at 11:49 AM

I wonder why the Create methods in the contents controller (Orchard.Core.Contents.Controllers.AdminController) check for Permissions.PublishContent. Since this is a create method, shouldn't it be sufficient to check for Permissions.PublishOwnContent (or possibly even Permissions.EditOwnContent)?

Jun 1, 2011 at 3:57 PM
Edited Jun 1, 2011 at 3:57 PM

Actually, PublishOwnContent is what will get checked (if PublishContent fails). You have to understand what's going on in the permissions service. When a permission is checked it gets passed through a series of events which can alter which permission gets checked. Then there's an event handler that looks for PublishContent, EditContent and DeleteContent, and will perform an additional check for the OwnContent varieties if needed. Of course the PublishContent permission trumps PublishOwnContent so gets checked first (I think, from memory).

There's a similar thing that happens for the content type specific permissions, i.e. PublishContent will then get translated to PublishContent_Page if the content type is Page. This all happens in Orchard.Core.Contents.

Jul 10, 2011 at 4:29 PM

Thanks for your help @randompete. I still wonder why the method CreateAndPublishPOST in the same controller checks for Permissions.PublishContent without an item. This is causing an issue for users with the "Author" role, who are unable to publish an item except after saving it first. I don't think this check is warranted, as the delegation to the method CreatePOST will eventually cause a check for publishing permissions with an item, allowing the dynamic logic of adding "own" variations to be executed.