permission

Maxxim · March 5th, 2006, 09:52 AM

First of all, congratulations for the book. I have learned a lot with him.

My Problem:
When I navigate into page "ShowAbstracts.aspx" I have a link in bottom of page: "LinkToSubmitNews -> "SubmitNews.aspx"

In the "ShowAbstracts.aspx" code-behind i have:

Code:

If Not (TypeOf Context.User Is SitePrincipal) _
                    OrElse Not CType(Context.User, SitePrincipal).HasPermission( _
                      CInt(NewsManagerPermissions.AdministerNews)) _
                    OrElse Not CType(Context.User, SitePrincipal).HasPermission( _
                      CInt(NewsManagerPermissions.PublishNews)) _
                    OrElse Not CType(Context.User, SitePrincipal).HasPermission( _
                      CInt(NewsManagerPermissions.SubmitNews)) Then

                LinkToSubmitNews.Visible = False
            End If

BUT, this only work if the current user have all the three permissions!
I've tried tu add a role "PublishNews" and when i navigate into that page, de link is visible-false.

It is enough that it does not have the permission "AdministerNews" for
the link came to visible:False !

What could i do?

Thank you very much!
Max, from Portugal

englere · March 5th, 2006, 07:16 PM

I'm not sure what the authors intended, but the code is saying that you need all permissions, just as you said. In the sample website, these 3 are all mapped the the same admin role, so it works for users in that role.

If you want to change the logic so you only need one of these permissions, you can just change the if statement. You should be careful with security changes so you don't give someone more permission than you really intended.

Eric

Maxxim · March 6th, 2006, 05:37 PM

I think that this part of code is wrong because it has this commentary:

Code:

' Check if the current user is allowed to submit or directly
' publish a news AdministerNews, SubmitNews and PublishNews
' are all, but if no one is present hide the link to that page

I've tried to change de statement but the page gave conflict when user was not registed and simply wanted to see the abstracts...

anyone know a identic code to use ?

Tkank you