Using MediaPicker without being Administrator and without being on a admin page

Topics: Customizing Orchard, Troubleshooting, Writing modules
Dec 5, 2012 at 1:52 PM

We are writing a new module (Orchard 1.3). There we have a web page with a TextArea, where we use TinyMce and within the Editor we want to use the MediaPicker for uploading Pictures:

@using Orchard.Utility.Extensions;
@{
    Html.Title("Contentblock " + Model.Name);
    Script.Require("OrchardTinyMce").AtFoot();
}
@model Teamaton.Discoverize.Models.ContentBlockPart
@using(Html.BeginFormAntiForgeryPost("Update"))
{
    <h2>@Html.DisplayTextFor(model => model.Name)</h2>
    <div>
        @Html.TextArea("Content", (string)Model.Content, 25, 80, new Dictionary<string, object> {
		{"class", "html tinymce"},
		{"data-mediapicker-uploadpath","ContentBlock"},
		{"data-mediapicker-title",T("Medien einfügen/ändern")}})
    </div>
    <button type="submit">Save</button>
    @Html.HiddenFor(model => model.Id)
}

We run into three problems:

1.) The MediaPicker window does not open when clicking on the Add-Media-Button. This seems to have to do with the Orchard.MediaPicker.AdminFilter.OnResultingExecuting(). There the MediaPicker.js-script is being included. And that even though we are logged in with an Administrator account.

2.) But even if we circumvent this with including the script in our view, we run into the next problem: In MediaPicker.js the location is being checked (line 18). We are not on a URL with "/admin/" in it.

3.) Even if we bypass 1. + 2. and we are logged in NOT as Administrator, the MediaPicker window opens, but says "Access Denied" and "You do not have permission to complete your request."

A) How can we adjust our code so that the users of the TextArea can use the MediaPicker without being Administrators?

B) What can we do so that MediaPicker.js does not kick us out when checking for the "/admin/" substring, which we do not have in our URL?

Coordinator
Dec 5, 2012 at 7:04 PM

It's this bug: http://orchard.codeplex.com/workitem/19163 

Dec 6, 2012 at 9:17 AM
Edited Dec 6, 2012 at 9:17 AM

Thanks for pointing us to the bug. For now we will adjust the script.

Is there a solution to our other question:

A) How can we adjust our code so that the users of the TextArea can use the MediaPicker without being Administrators?

Is there a possibility to circumvent all the AdminFilter methods? Or simulate the admin rights without being logged in as an admin?

Coordinator
Dec 7, 2012 at 2:21 AM

No, until the bug is fixed, workarounds would be to roll your own media picker or monkey-patch the one in core.