Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add UI permissions based on the user role #6823

Merged
merged 4 commits into from
Aug 27, 2020
Merged

Add UI permissions based on the user role #6823

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
250bfb9
Add UI permissions based on the user role
hishamco Aug 17, 2020
0a06083
Add missing bracket
hishamco Aug 17, 2020
5152b5e
Remove unnecessary check
hishamco Aug 17, 2020
cd9b537
Remove unnecessary condition due merge conflict
hishamco Aug 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion src/OrchardCore.Modules/OrchardCore.ContentPreview/Views/ContentPreview.Button.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,18 @@
@using Microsoft.AspNetCore.Authorization
@using OrchardCore.ContentManagement
@using OrchardCore.ContentPreview
@inject IAuthorizationService AuthorizationService

@{
ContentItem contentItem = Model.ContentItem;
var previewId = Guid.NewGuid();
var hasPreviewPermission = await AuthorizationService.AuthorizeAsync(User, Permissions.ContentPreview, contentItem);
}

<a id="previewButton" target="_blank" class="publish-button btn btn-info" href="@Url.Action("Index", "Preview", new { area = "OrchardCore.ContentPreview", id = previewId })">@T["Preview"]</a>
@if(hasPreviewPermission)
{
<a id="previewButton" target="_blank" class="publish-button btn btn-info" href="@Url.Action("Index", "Preview", new { area = "OrchardCore.ContentPreview", id = previewId })">@T["Preview"]</a>
}

<div id="renderPreviewUrl" style="display:none" data-value="@Url.Action("Render", "Preview", new { area = "OrchardCore.ContentPreview" })" ></div>
<div id="contentItemType" style="display:none" data-value="@Model.ContentItem.ContentType"></div>
Expand Down
38 changes: 22 additions & 16 deletions src/OrchardCore.Modules/OrchardCore.Contents/Views/Content.PublishButton.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,28 @@
@*@if (Authorizer.Authorize(Permissions.PublishContent, (IContent)Model.ContentItem)) {*@
@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

@{
ContentItem contentItem = Model.ContentItem;
var returnUrl = Context.Request.Query["returnUrl"];
var hasPublishContentPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.PublishContent, contentItem);
Copy link
Contributor

@Skrypt Skrypt Sep 17, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PublishOwnContent. These permissions are not taking in consideration when we want to use PublishOwn or EditOwn they need to be changed.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These permissions are not taking in consideration when we want to use PublishOwn or EditOwn

Why?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Skrypt code is good here I think. a PublishContent permission request is morphed to PublishOwn. You shouldn't request PublishOwn directly (see comments in CommonPermissions)

Copy link
Contributor

@Skrypt Skrypt Sep 18, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn't work if you have set a PublishOwn_ContentTypeName permission which is dynamic. So the issue is that the PR makes it impossible to have a role that has Publish/Edit/Delete own permission on a single custom content type. I have a PR coming up.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See https://github.com/OrchardCMS/OrchardCore/blob/dev/src/OrchardCore.Modules/OrchardCore.Contents/Security/ContentTypeAuthorizationHandler.cs#L58

}
@if (String.IsNullOrWhiteSpace(returnUrl))
{
<button type="submit" name="submit.Publish" class="publish-button btn btn-success" value="submit.Publish">@T["Publish"]</button>
}
else

@if(hasPublishContentPermission)
{
<div class="btn-group">
<button class="publish-button btn btn-success" type="submit" name="submit.Publish" value="submit.Publish">@T["Publish"]</button>
<button type="button" class="btn btn-success dropdown-toggle dropdown-toggle-split" data-reference="parent" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
<span class="sr-only">@T["Toggle Dropdown"]</span>
</button>
<div class="dropdown-menu">
<button class="dropdown-item" type="submit" name="submit.Publish" value="submit.PublishAndContinue">@T["and continue"]</button>
if (String.IsNullOrWhiteSpace(returnUrl))
{
<button type="submit" name="submit.Publish" class="publish-button btn btn-success" value="submit.Publish">@T["Publish"]</button>
}
else
{
<div class="btn-group">
<button class="publish-button btn btn-success" type="submit" name="submit.Publish" value="submit.Publish">@T["Publish"]</button>
<button type="button" class="btn btn-success dropdown-toggle dropdown-toggle-split" data-reference="parent" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
<span class="sr-only">@T["Toggle Dropdown"]</span>
</button>
<div class="dropdown-menu">
<button class="dropdown-item" type="submit" name="submit.Publish" value="submit.PublishAndContinue">@T["and continue"]</button>
</div>
</div>
</div>
}
}

@* } *@
35 changes: 22 additions & 13 deletions src/OrchardCore.Modules/OrchardCore.Contents/Views/Content.SaveDraftButton.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,28 @@
@using Microsoft.AspNetCore.Authorization
@inject IAuthorizationService AuthorizationService

@{
ContentItem contentItem = Model.ContentItem;
var returnUrl = Context.Request.Query["returnUrl"];
var hasEditContentPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.EditContent, contentItem);
}
@if (String.IsNullOrWhiteSpace(returnUrl))

@if(hasEditContentPermission)
{
<button class="primaryAction btn btn-primary" type="submit" name="submit.Save" value="submit.Save">@T["Save Draft"]</button>
}
else
{
<div class="btn-group">
<button class="btn btn-primary" type="submit" name="submit.Save" value="submit.Save">@T["Save Draft"]</button>
<button type="button" class="btn btn-primary dropdown-toggle dropdown-toggle-split" data-reference="parent" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
<span class="sr-only">@T["Toggle Dropdown"]</span>
</button>
<div class="dropdown-menu">
<button class="dropdown-item" type="submit" name="submit.Save" value="submit.SaveAndContinue">@T["and continue"]</button>
if (String.IsNullOrWhiteSpace(returnUrl))
{
<button class="primaryAction btn btn-primary" type="submit" name="submit.Save" value="submit.Save">@T["Save Draft"]</button>
}
else
{
<div class="btn-group">
<button class="btn btn-primary" type="submit" name="submit.Save" value="submit.Save">@T["Save Draft"]</button>
<button type="button" class="btn btn-primary dropdown-toggle dropdown-toggle-split" data-reference="parent" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
<span class="sr-only">@T["Toggle Dropdown"]</span>
</button>
<div class="dropdown-menu">
<button class="dropdown-item" type="submit" name="submit.Save" value="submit.SaveAndContinue">@T["and continue"]</button>
</div>
</div>
</div>
}
}
14 changes: 13 additions & 1 deletion src/OrchardCore.Modules/OrchardCore.Contents/Views/Content.SummaryAdmin.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
<button type="button" class="btn btn-secondary btn-sm dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
@T["Actions"]
</button>
<div class="dropdown-menu dropdown-menu-right">
<div id="actionsMenu" class="dropdown-menu dropdown-menu-right">
@await DisplayAsync(Model.ActionsMenu)
</div>
</div>
Expand All @@ -57,3 +57,15 @@
{
<div class="col primary">@await DisplayAsync(Model.Content)</div>
}

<script at="Foot" type="text/javascript">
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not use a named script with a class selector ? Instead of having tons of instances of this code on the page ?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@netwavebe already fixed it @jptissot exactly as you suggested.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah cool, I did not realize this was an old pr :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It got merged to dev a few days ago. See #7070

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @netwavebe :)

$(function(){

$("#actionsMenu.dropdown-menu").each(function(i, e){
var count = $(e).children().length;
if(count == 0){
$(this).parent().hide();
}
});
});
</script>
19 changes: 15 additions & 4 deletions ...rchardCore.Modules/OrchardCore.Contents/Views/Contents-Button-Actions.SummaryAdmin.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,23 @@
var hasPublished = await ContentManager.HasPublishedVersionAsync(contentItem);
var hasDraft = contentItem.HasDraft();
var hasClonePermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.CloneContent, contentItem);
var hasDeletePermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.DeleteContent, contentItem);
var hasEditPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.EditContent, contentItem);
var hasPreviewPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.PreviewContent, contentItem);
var hasPublishPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.PublishContent, contentItem);
}

@if (hasDraft)
{
<a asp-action="Publish" asp-controller="Admin" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" asp-route-returnUrl="@FullRequestPath" itemprop="UnsafeUrl" class="dropdown-item btn-sm">@T["Publish Draft"]</a>
<a asp-action="Preview" asp-controller="Item" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" class="dropdown-item btn-sm">@T["Preview Draft"]</a>
if(hasPublishPermission)
{
<a asp-action="Publish" asp-controller="Admin" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" asp-route-returnUrl="@FullRequestPath" itemprop="UnsafeUrl" class="dropdown-item btn-sm">@T["Publish Draft"]</a>
}

if(hasPreviewPermission)
{
<a asp-action="Preview" asp-controller="Item" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" class="dropdown-item btn-sm">@T["Preview Draft"]</a>
}

<div class="dropdown-divider"></div>
}
Expand All @@ -21,12 +32,12 @@
<a asp-action="DiscardDraft" asp-controller="Admin" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" asp-route-returnUrl="@FullRequestPath" itemprop="UnsafeUrl RemoveUrl" data-title=@T["Discard Draft"] data-message=@T["Are you sure you want to discard this draft?"] data-ok-text="@T["Yes"]" data-cancel-text="@T["No"]" data-ok-class="btn-primary" class="dropdown-item btn-sm">@T["Discard Draft"]</a>
}

@if (hasPublished)
hishamco marked this conversation as resolved.
Show resolved Hide resolved
@if (hasPublished && hasEditPermission)
{
<a asp-action="Unpublish" asp-controller="Admin" asp-route-area="OrchardCore.Contents" asp-route-contentItemId="@contentItem.ContentItemId" asp-route-returnUrl="@FullRequestPath" itemprop="UnsafeUrl RemoveUrl" data-title=@T["Unpublish"] data-message=@T["Are you sure you want to unpublish this item?"] data-ok-text="@T["Yes"]" data-cancel-text="@T["No"]" data-ok-class="btn-primary" class="dropdown-item btn-sm">@T["Unpublish"]</a>
}

@if (hasDraft || hasPublished)
@if ((hasDraft || hasPublished) && hasDeletePermission)
{
<a remove-for="@contentItem" class="dropdown-item btn-sm" asp-route-returnUrl="@FullRequestPath" itemprop="RemoveUrl UnsafeUrl" data-title="@T["Delete"]" data-message="@T["Are you sure you want to delete this content item?"]">@T["Delete"]</a>
}
Expand Down
8 changes: 7 additions & 1 deletion src/OrchardCore.Modules/OrchardCore.Contents/Views/Contents-Button-Edit.SummaryAdmin.cshtml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,18 @@
@using Microsoft.AspNetCore.Authorization
@using OrchardCore.ContentManagement
@inject IAuthorizationService AuthorizationService
@inject IContentManager ContentManager

@{
ContentItem contentItem = Model.ContentItem;
var hasPublished = await ContentManager.HasPublishedVersionAsync(contentItem);
var hasEditContentPermission = await AuthorizationService.AuthorizeAsync(User, OrchardCore.Contents.Permissions.EditContent, contentItem);
}

<a edit-for="@contentItem" asp-route-returnUrl="@FullRequestPath" class="btn btn-primary btn-sm">@T["Edit"]</a>
@if(hasEditContentPermission)
{
<a edit-for="@contentItem" asp-route-returnUrl="@FullRequestPath" class="btn btn-primary btn-sm">@T["Edit"]</a>
}

@if (hasPublished)
{
Expand Down