كيف يقدم أحد الرابط المشذز لأمان في قالب عرض؟[تم حلها]

Question

في WebPart المستندة إلى ListView ListView / DataForm XSL، يمكنك إلقاء بعض XSLT من شأنها أن تقدم رابطا إذا كان لدى المستخدم المشاهدة امتيازات كافية مثل: giveacodicetagpre.

سؤالي هو كيف يقدم المرء رابطا مضطربا في بيئة قالب العرض الجديد؟

Answer 1

So what I ended up doing is creating a user control that is referenced in my master page; this control throws down some hidden fields that render out what access the current user has. I can then use those hidden flags in my display template to show/hide conditional content. A key point is to use ClientIDMode="Static" since you can't guarantee that jQuery is loaded when your display template renders.

Asp Code:

<span id="uinfo" style="display:none;">
    <asp:HiddenField ID="HdnIsAnonymous" runat="server" Value="1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnIsSteAdm" runat="server" Value="-1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnMgCurWeb" runat="server" Value="-1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnContrCurWeb" runat="server" Value="-1" ClientIDMode="Static" />
</span>

Code behind:

string siteUrl = SPContext.Current.Site.Url;
string webUrl = SPContext.Current.Web.Url;
bool isAnonymous = SPContext.Current.Web.CurrentUser == null;

if (!isAnonymous && !SharePointHelper.IsCurrentPageInEditMode)
{
    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite elevatedSite = new SPSite(webUrl))
        {
            // Check the current web and verify if the current user can manage the web and or contribute pages.
            using (SPWeb elevatedCurrentWeb = elevatedSite.OpenWeb())
            {
                HdnMgCurWeb.Value = elevatedCurrentWeb.DoesUserHavePermissions(SPBasePermissions.ManageWeb) ? "1" : "0";
                SPList pagesList = elevatedCurrentWeb.Lists.TryGetList("Pages");
                if (pagesList != null)
                {
                    HdnContrCurWeb.Value = pagesList.DoesUserHavePermissions(SPBasePermissions.EditListItems) ? "1" : "0";
                }
            }
        }
    }
    HdnIsSteAdm.Value = (SPContext.Current.Web.CurrentUser.IsSiteAdmin ? "1" : "0");
}
HdnIsAnonymous.Value = (isAnonymous ? "1" : "0");

Display Template Code:

<!--#_
var canEdit = false;
var canEditFlagElem = $get("HdnContrCurWeb");
if (canEditFlagElem)
{
    canEdit = canEditFlagElem.value == "1";
}

_#-->

...

<!--#_ if(canEdit) { _#-->
        <div style="text-align:right;margin-right:12px;">
            <span class="link-item"><a>Security trimmed link</a>
        </div>
<!--#_ } _#-->

Granted, a malicious user could find the link location in the display template code and load it up, but it's really not a problem because SharePoint security will take over from there.

This is superior to issuing JSOM SP.js calls IMHO, which require a minimum of two callbacks after the page loads to check permissions, this data that is rendered via the control is also generic information that can be used by all display templates on the page, and is the best option in terms of performance and decreased requests.