1

Closed

Content Menu Item Navigation Menu Display Issues

description

I have been working with the Content Menu Item Navigation and am having trouble getting it to function properly when the roles are used to restrict a user's access to certain content types. From everything I can tell, the issue is that a "Content Menu Item Part" has it's own Content Id and does not utilize the Content Id of the associated Content it is related to. This being the case, the security that is being checked in the "Orchard.UI.Navigation.NavigationManager.cs" line 97 is checking authorization permissions for the Content Item representing the Content Menu Item part and NOT the associated content (e.g. a page, a projection). As such, there is no way to properly restrict access to roles and use the "Content Menu Item" type in Navigation since all "Content Menu Item" menus will not be displayed.

One solution I was considering is to expand the "NavigationManager.cs" on line 97 to see if the content was a Content Menu Item, and, if it was, then I would grab the Content that is being referenced by the ContentMenuItemPart. However, in order to do this I would need to add a reference to Orchard.Core and that doesn't make good sense to have Orchard.Framework dependent on Orchard.Core (as it is not already and structurally does not seem it should be). Hopefully you can provide another alternative.
Closed Jan 15 at 8:01 PM by sebastienros

comments

sebastienros wrote Nov 6, 2012 at 8:07 PM

On 1.6 ?

jao28 wrote Nov 6, 2012 at 8:48 PM

Fantastic, I just walked through this in 1.6 and it now works exactly as I expect - thanks. The only one left that is questionable is the "Custom Link". Even though it points to a "Page" that the user has permissions for, it is not handled as though the user has permissions. I can see that this may be by design, after all, if it is something local on Orchard a "Content Menu Item" should be used rather than a "Custom Link". So, looks like everything is good to go. Now I just need to update everything to 1.6.

For completeness and in case anyone is wondering what actually works, here are the repro steps that would have produced the issue:
  1. Create a new page (don't attach it to the menu directly)
  2. Go to "Navigation" in the admin menu
  3. Click on "Content Menu Item --> Add"
  4. Browse to the content item (the new page that was created in step 1)
  5. Save your changes to the "Conent Menu Item"
  6. Go to "Users --> Roles"
  7. Edit the "Anonymous" role
  8. In "Contents Feature" section uncheck the "View all Content" option
  9. In "Page" section" sectioin check the "View Page by others" optioin
  10. Press "Save" to update the "Anonymous" role
  11. Log out
What you used to see (before 1.6) is that the page navigation would not appear for the page, even though the user had access rights to the page. Now everythign works out and the Navigation displays as expected.

Thanks again.

Sign in to add a comment