How to allow SiteUser's to edit his pages and childs only

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

Please do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.

This forum is for discussing mojoPortal development

This forum is only for questions or discussions about working with the mojoPortal source code in Visual Studio, obtaining the source code from the repository, developing custom features, etc. If your question is not along these lines this is not the right forum. Please try to post your question in the appropriate forum.

You can monitor commits to the repository from this page. We also recommend developers to subscribe to email notifications in the developer forum as occasionally important things are announced.

Before posting questions here you might want to review the developer documentation.

Do not post questions about design, CSS, or skinning here. Use the Help With Skins Forum for those questions.
This thread is closed to new posts. You must sign in to post in the forums.
11/29/2009 6:54:38 PM
Gravatar
Total Posts 70

How to allow SiteUser's to edit his pages and childs only

Hello All,

I'll need a feature and was wondering if any one already did somehting like it.

What I need: Create a "default" page for every user after registration. Give the user permission to edit and create child pages. User will have this permissions only to his page and childs. I dont want to create a role for every user (will be too many).  

Where I'm heading: Use the RegistrationHandler to create the page. Build a custom table where I'll keep the user and his "default" page. Change the behavior of the authentication to allow users who "own" the page to edit and creat childs under it. 

Where I'm lost: Couldn't find a way to allow the user to edit his pages without messing in the mojoportal core. 

Maybe something like the "UserSignInHandler" ( "UserCanEditHandler" ) could allow me to implement the "custom rule". 

Any sugestions?

11/30/2009 1:48:07 PM
Gravatar
Total Posts 18439

Re: How to allow SiteUser's to edit his pages and childs only

Hi,

Currently all things are checked against roles, so the shortest path to do what you want right away is to create roles corresponding to users. I will ponder this, but nothing is coming soon for this. 

It sounds like you are trying to build a social networking site. I would caution you against letting strangers register on your site and then allow them to create or edit pages using mojoPortal features. mojoPortal features provide too much power and you should not let untrusted users have access to them on your site. Using the Html or Blog feature for example users can introduce javascript into the page and try to do xss attacks and steal cookies and try to install malware and all manner of mischief. These features were designed for trusted users who own the web site not for public users.

Best,

Joe

11/30/2009 2:06:24 PM
Gravatar
Total Posts 4

Re: How to allow SiteUser's to edit his pages and childs only

I just asked a similar question.  Hmmmm..... I mojoPortal is setup perfect, except I want a user to only be able see and access Documents he Owns.

I'm totally new to web administration.  I am not new to Windows Forms or services.  What I did was I created a Upload Web Service to handle large files that I can access with windows forms using MTOM.  I want MyService under my domain that mojo is under and I want to add a table in the SQL database to record files that are uploaded.  Reason being is that I want to upload files that have children files.

11/30/2009 2:17:35 PM
Gravatar
Total Posts 18439

Re: How to allow SiteUser's to edit his pages and childs only

Jesse,

Your question was similar but about sub sites, with sub sites at least if using different host names for the sites they would have independent logins and content and no malicious script from one can get to the other so there is not so much risk there. There is some potential risk with folder based sub sites because cookies are per domain not per folder and if someone in a folder sub site adds malicious javascript he can potentially steal cookies from any of the sites if the user visits his sub site.

You can create a sub tree within a site that a user can edit as bprado is talking about doing and you can give a user a folder sub site and it will be fine if they are trusted users but if you are letting anyone sign up then you need much more control over what they can and can't do and you don't want them to have the power provided in the mojoPortal content features because as I said these features allow the user to do things that could be bad in order to allow them to also do cool good things by letting them put javascript in the page.

mojoPortal is not a framework for building social networking sites, the security issues in a social networking site are much different and that is not currently a goal for the project. mojoPortal aims to provide what is needed for a business web site with social features to leverage other social networking sites for promotion but not to build the next facebook.

Best,

Joe

11/30/2009 5:24:25 PM
Gravatar
Total Posts 70

Re: How to allow SiteUser's to edit his pages and childs only

Hi Joe !!! 

Thanks for the answer !!!

Actually the users with that kind of permission will be secure and validated users. Imagine a site where "churchs" (example) can register and manage their pages. Only after documental comprovation they gain full access. And everyone else can register and have access to those pages (read only access). The problem is when we have thousands of "churchs" and can't manage thousands of roles.

Please let me know what you think of my plans:

- create a new table to keep track of "page owners" (could add a new field to mp_table but that would mess with the core and I'll try to avoid this).

- create a new table to "mark" a role as "user based". 

- create a Handler that can be customized to override the read of "CreateChildPageRoles" and "EditRoles" in PageSettings.cs. (here I'll need to merge 4 life :)

- Implement the Handler in a way that if a role is "user based" it will only be returned if SiteUser is the owner of the page. 

11/30/2009 9:06:15 PM
Gravatar
Total Posts 4

Re: How to allow SiteUser's to edit his pages and childs only

Isn't Joe great!  Thanks for all your help.  You are correct.  Mojo is great for a business platform.  Mojo was the only site I could get up and running for my biz.  None of the ASP templates on MSDN would work for me.

I geuss I have a different idea that I need different tools for.  Even a social networking site isn't quite what I'm looking for.  I guess what I'll do for now is set up subsites for users manually until I catch some ground here.  I don't think I'm going to have 170000 hits right away.

As far as MyWebService goes.  This may be beyond the scope, not the knowledge of course, of the friends here.  Can I place it under the root somewhere and where do I physically put it??

11/30/2009 9:08:29 PM
Gravatar
Total Posts 4

Re: How to allow SiteUser's to edit his pages and childs only

Just to clarify, I will prefer to use mojo for my biz site and most likely use it for a long time.  As far as my hair-brained ideas, I might have to venture out and even to a different host.

12/1/2009 7:33:27 AM
Gravatar
Total Posts 18439

Re: How to allow SiteUser's to edit his pages and childs only

bprado,

I wonder do you really want the content of 1000 churches all in one site or do you want to create a site for each church?

If you create a folder sub site for each church then you don't need 1000 roles in one site, you just make the appropriate person content administrator in his own site and then at least you don't have to customize mojoportal core because you still use roles to control who can edit.

I guess you would have some lookup list in the OnRegister event to check if the user registering is on the list of approved to have their own site and if the site is not already created. This way you don't do anything when other users register.

Best,

Joe

12/1/2009 7:37:25 AM
Gravatar
Total Posts 18439

Re: How to allow SiteUser's to edit his pages and childs only

Jesse,

If you have a question about web services or file uploads please start a new thread, it makes it easier for others to find answers in search if we keep it to one topic per thread.

I will say it would be better if you could run in full trust and use NeatUpload. The problem with normal ASP.NET upload is that the entire file must be loaded into server memory and this would not be any different with a web service vs a web page, whereas NeatUpload can stream it to disk without loading the whole file into server memory so it does a better job with large files and also has a progress bar.

Best,

Joe

12/1/2009 5:31:10 PM
Gravatar
Total Posts 70

Re: How to allow SiteUser's to edit his pages and childs only

OMG Joe !!! I'm starting to get it !!! 

I' m new to Mojo and, from what I knew so far, I got the impression that each site in a multi-site installation had their own "user lists". STUPID ME stopped reading the doc's in first paragraph .... and missed the " new feature "  that shares user and roles between sites. OMG !!!! 3 days burning my brain !!!!!

Thank you very much for making me see it :) 

I just hope MojoPortal can Handle 100k sub sites and 10M users !!!!!!  I'm back to business again :) 

PS: And if I really get my Idea rolling and $$ coming you will get FBFL (Free Beer For Life) lol :) 

12/1/2009 7:19:02 PM
Gravatar
Total Posts 70

Re: How to allow SiteUser's to edit his pages and childs only

Something went wrong JOE. Could not set the role only for one subsite. Don't matter where I add the user to the role (in the main site or in the subsite) he get's content manager in all subsites (including the root site).

Maybe I'm not understanding how this work's ... Any clues?

EDIT: I found that even if I'm in a sub-site, mojoportal set's the role of the "root site" (siteid = 1) and not the "new one" (siteid = 3) created to the site. Maybe it's a bug? Any help would be appreciated ....

12/2/2009 10:40:03 AM
Gravatar
Total Posts 18439

Re: How to allow SiteUser's to edit his pages and childs only

Hi,

It sounds like you have <add key="UseRelatedSiteMode" value="true" /> which makes it share users and roles across all sites. You can either set that to false and then the sites will have independent users and roles and therefore Content Administrators from one site are not also Content Administrators in the other sites. Or, if you do want to share users and roles across sites then you would need to make a role per site and set it as the siteSettings.SiteEditorRoles on each site to enable different editors in each site without making them Content Administrators. With related sites mode enabled then anyone in the Admins Role or Content Admintratorss role can edit anything in any of the sites but users in roles created and attached as SiteEditorRoles can only edit within the specific site.

Hope it helps,

Joe

12/4/2009 3:18:06 PM
Gravatar
Total Posts 70

Re: How to allow SiteUser's to edit his pages and childs only

Thanks Joe.

I guess there's no " way out" other than customizing ... Thanks 4 all the support.

You must sign in to post in the forums. This thread is closed to new posts.