In addition to exposing methods for data-related work, ForumModule API also exposes several security functions. This topic examines some security methods for the Forums
module.
The way security works in Sitefinity is very simple. A new instance of GlobalPermission object should be instantiated and Demand() or
CheckDemand() functions should be called. The Demand() function will throw a security exception in case currently-logged-in user has no
permissions for the given operation, while CheckDemand() will return false if user does NOT have permissions for the requested action, and
true if user has the permissions for the required action.
Usually, the CheckDemand() function is used for showing/hiding UI elements (for example, if user has no permissions for creating new forum item, we should hide
the “Create new forum item” button), while Demand() is used prior to executing the actual action.
The way in which the GlobalPermission object is instantiated is very important because, ultimately, this is how we define what kind of permission we are looking for.
ForumManager exposes two different ways for getting the GlobalPermission object for ForumModule:
- GetPermission() – which will return the permission for the current provider
- GetPermission(int requestRights) – which will return permission for the specified rights
Every GetPermission function returns an object of GlobalPermission, which has Demand() and
CheckDemand() functions.
The following examples demonstrate how to use the ForumModule Security API:
Get user’s permission to work with the provider with which ForumManager has been instantiated:
| GetPermission() |
 Copy Code |
|
// create new instance of ForumManager
Telerik.Forums.ForumManager forumManager = new Telerik.Forums.ForumManager();
// obtain provider permission for currently-logged-in user
Telerik.Forums.Security.GlobalPermission providerPermission = forumManager.GetPermission();
// check if user has
permission to work with the current provider
bool userCanWorkWithCurrentProvider =
providerPermission.CheckDemand();
// ... perform some logic here based on the user's provider permission
// demand user's permission to work with the current provider
// note that security exception will be thrown if user has no provider permissions
// use CheckDemand() if you only need to check if user has permission
providerPermission.Demand();
|
Get user’s permission to do specific work with the Forum module:
| |
Copy Code |
|
// create new instance of ForumManager
Telerik.Forums.ForumManager forumManager = new Telerik.Forums.ForumManager();
// obtain deleting permission for currently-logged-in
user
Telerik.Forums.Security.GlobalPermission deletePermission =
forumManager.GetPermission(Telerik.Security.Permissions.CrudRights.Delete);
// check if user has permission to perform
delete operations in ForumModule
bool userCanDelete =
deletePermission.CheckDemand();
// ... perform some logic here based on the user's provider permission
// demand user's permission to perform delete operations in ForumModule
// note that security exception will be thrown if user has no such permission
// use CheckDemand() if you only need to check if user has permission
deletePermission.Demand();
|
See Also