Secured providers must inherit from DataProviderBase. It has several important members that you should be aware of.
Override to customize the permission sets used by your provider.
/// Gets the permission sets relevant to this specific secured object.
/// To be overridden by relevant providers (which involve security roots)
/// <value>The supported permission sets.</value>
/// Default supported permission sets for the News module are General and Comments.
/// General is used for News items and Comments is used for comment related to news items.
.supportedPermissionSets.Length == 0)
.supportedPermissionSets = value;
/// Use property instead of direct access.
Sets default permissions (using the general permission set). Reasonable defaults are set: everyone is allowed to view items and backend users are allowed to create and delete.
If the security root supports comments, everyone will be allowed to create and view them, but only backend users will be able to delete and mofify.
Here is how you can override it:
/// Sets the root permissions.
/// <param name="root">The root.</param>
|| root.Permissions.Count > 0)
var securityCong = Config.Get<SecurityConfig>();
var everyoneId = securityCong.ApplicationRoles[SecurityConstants.AppRoles.Everyone].Id;
var backendId = securityCong.ApplicationRoles[SecurityConstants.AppRoles.BackendUsers].Id;
var ownerId = securityCong.ApplicationRoles[SecurityConstants.AppRoles.Owner].Id;
var permissionsForEveryoneToCreateComments =
.CreatePermission(SecurityConstants.Sets.Comments.SetName, root.Id, everyoneId);
, SecurityConstants.Sets.Comments.View, SecurityConstants.Sets.Comments.Create);
var permissiosForBackendUsersToModifyAndDeleteComments =
.CreatePermission(SecurityConstants.Sets.Comments.SetName, root.Id, backendId);
, SecurityConstants.Sets.Comments.Modify, SecurityConstants.Sets.Comments.Delete);
var permissionsforEveryoneToViewNewsItems =
.CreatePermission(SecurityConstants.Sets.General.SetName, root.Id, everyoneId);
var permissionsForBackendUserstoCreateNewsItems =
.CreatePermission(SecurityConstants.Sets.General.SetName, root.Id, backendId);
var permissionsForOwnersToModifyAndDeleteNewsItems =
.CreatePermission(SecurityConstants.Sets.General.SetName, root.Id, ownerId);
, SecurityConstants.Sets.General.Modify, SecurityConstants.Sets.General.Delete);
Returns a cached instance of the security root. You should not have reasons to override this in you modules.
If secured object and permission are created in different providers, this will use a common transaction to safely add a permission to the secured object. You don't need to override this, as this is responsibility of the decorator.
Gets the all the secured objects which inherit permissions, through permissions hierarchy, from a secured object.
Gets a dictionary:
Security-related attributes will be discussed in greater detail, but here is an overview on how you should apply them in your providers: PermissionAttributes#SampleUsage
The general idea is that you have to map provider methods to security actions, this informing Sitefinity CMS what permissions to check when certain methods are invoked.
NOTE: You probably noted the CommitTransaction override. While we don't add any functionality, we add a new attribute. Sitefinity CMS works in transactions, and certain permissions checking is possible at transaction commit time only (e.g. modify).
IMPORTANT: Methods that have attributes applied on them sould be virtual. Sitefinity's security engine uses method interception, and for this to work, your classes are overriden in dynamic modules. If your methods are not virtual, the IoC framework we use wouldn't be able to override them, thus interception won't work. As a result of this, security (automatic demanding)will not be applied.
In the delete method of a data provider, the developer should call this code:
var securityRoot = this.GetSecurityRoot();
if (securityRoot != null)
While this is implemented for the core static modules, you should handle it in your types so that the table sf_permissions_inheritance_map can avoid being flooded with unused ids.
Back To Top