Comment cela fait-il un lien garni de sécurité dans un modèle d'affichage?[RESOLU]

Question

Dans l'ancienne WebPart basée sur ListView / dataform XSL, vous pouvez jeter certains XSLT qui rendraient un lien si l'utilisateur de la visualisation disposait de privilèges suffisants comme:

<xsl:choose>
  <xsl:when test="ddwrt:IfHasRights(16)">
    <div>
      <div style="float:right;">
        <a href="{$RootSiteUrl}/{$dvt_adminurl}" class="ms-rteElement-arrowLink">Manage</a>
      </div>
      <span class="clear"></span>
    </div>
  </xsl:when>
</xsl:choose>

Ma question est de savoir comment accomplir un lien tamisé de sécurité dans le nouvel environnement de modèle d'affichage?

Answer 1

So what I ended up doing is creating a user control that is referenced in my master page; this control throws down some hidden fields that render out what access the current user has. I can then use those hidden flags in my display template to show/hide conditional content. A key point is to use ClientIDMode="Static" since you can't guarantee that jQuery is loaded when your display template renders.

Asp Code:

<span id="uinfo" style="display:none;">
    <asp:HiddenField ID="HdnIsAnonymous" runat="server" Value="1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnIsSteAdm" runat="server" Value="-1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnMgCurWeb" runat="server" Value="-1" ClientIDMode="Static" />
    <asp:HiddenField ID="HdnContrCurWeb" runat="server" Value="-1" ClientIDMode="Static" />
</span>

Code behind:

string siteUrl = SPContext.Current.Site.Url;
string webUrl = SPContext.Current.Web.Url;
bool isAnonymous = SPContext.Current.Web.CurrentUser == null;

if (!isAnonymous && !SharePointHelper.IsCurrentPageInEditMode)
{
    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite elevatedSite = new SPSite(webUrl))
        {
            // Check the current web and verify if the current user can manage the web and or contribute pages.
            using (SPWeb elevatedCurrentWeb = elevatedSite.OpenWeb())
            {
                HdnMgCurWeb.Value = elevatedCurrentWeb.DoesUserHavePermissions(SPBasePermissions.ManageWeb) ? "1" : "0";
                SPList pagesList = elevatedCurrentWeb.Lists.TryGetList("Pages");
                if (pagesList != null)
                {
                    HdnContrCurWeb.Value = pagesList.DoesUserHavePermissions(SPBasePermissions.EditListItems) ? "1" : "0";
                }
            }
        }
    }
    HdnIsSteAdm.Value = (SPContext.Current.Web.CurrentUser.IsSiteAdmin ? "1" : "0");
}
HdnIsAnonymous.Value = (isAnonymous ? "1" : "0");

Display Template Code:

<!--#_
var canEdit = false;
var canEditFlagElem = $get("HdnContrCurWeb");
if (canEditFlagElem)
{
    canEdit = canEditFlagElem.value == "1";
}

_#-->

...

<!--#_ if(canEdit) { _#-->
        <div style="text-align:right;margin-right:12px;">
            <span class="link-item"><a>Security trimmed link</a>
        </div>
<!--#_ } _#-->

Granted, a malicious user could find the link location in the display template code and load it up, but it's really not a problem because SharePoint security will take over from there.

This is superior to issuing JSOM SP.js calls IMHO, which require a minimum of two callbacks after the page loads to check permissions, this data that is rendered via the control is also generic information that can be used by all display templates on the page, and is the best option in terms of performance and decreased requests.