I am looking for some pointers on how it could be possible to control access to tabs in the Umbraco UI. It would be helpful to have the ability to specify which UserGroups have access to tabs and the ideal place to do this would be in the dashboard.config.
Is this possible now or is a hack required?
By tabs, do you mean the sections in the lower left area of the umbraco backend? Editors can be restricted to specific sections from the Users section, where you can tick off the sections available to each editor user.
If you mean tabs on Document Types, I don't know of any way to do this.
I believe that you'd need to modify the Umbraco core, the user permissions are only at a node level, not at a node property level.
If you wanted a hack you could have a custom data type which looks at the user group and injects JavaScript which either removes or disables the tabs depending on the user permissions.
Like I said it's a hack ;)
Dennis, the area you are referring to I call sections and not tabs. The tabs I was referring to were the ones that hold user controls and are controlled via the dashboard.config.
Slace, thanks and that is what I was hoping wouldn't be the case however looks like it might be the only option at the moment unless in future something is built into the core which I think should be and controlled via dashboard.config.
Example of how th dashboard.config tab node could look:
<tab caption="Search" usergroups="admin,editor">
<control>/usercontrols/dashboard/MemberSearch.ascx</control>
</tab>
I have a working solution for this now that I hope to be able to post for others very soon. I am just trying to make it less of a hack and more of a future proof addition to Umbraco as I can.
I don't recall this problem/ feature having been raised to the core team prior to now so it's not something that we have previously though of implementing. In addition I don't think that this will be very high on the feature list. It definately wouldn't make a v4.1 release and I really doubt it would make it to a v5 release unless it was in very high demand.
If you do think it's a valuable feature please feel free to add it to codeplex and if it is voted into a very high position we'll be more likely to investigate ho to achieve it.
In the meantime I plan to offer a package to allow others to add the option to their installs. To be honest I would be surprised if I am the only developer not to have the need to hide certain things from different user types but still needing to give that group access to a particular section.
New work item created - please vote now!
umbraco.codeplex.com/.../View.aspx?...Id=23256
You could copy all of the functionality from the editContent page from the Umbraco source and create your own page and add whatever custom functionality you like (using member roles, etc... to limit security for tabs), then add a URL rewrite for the editContent page in the admin section to point to your custom page.
Another way to do custom security for editing content is just create your own custom data types which lock content down based on roles, etc...
This is a bit of a ui hack and is security by obscurity but it does the trick from the user interface perspective, and prevents you from having to recompile the source.
I have created a usercontrol and placed it in the editcontent.aspx file. On loading of the page it checks the currently logged in user and if not an admin user, registers a jquery function to hide any tab prefixed with an asterisk as it's name. When creating a document type, simply store all "admin" properties on one or more tabs prefixed with a '*' and the properties will only be available to 'admin' users. This obviously can be extended with a prefix character per user role to hide tabs per role.
Create a new usercontrol (ASCX) file with the following code and save it to the usercontrols folder.
<%@ Control Language="C#" AutoEventWireup="true" %>
<script runat="server">
protected void Page_Load(object sender, EventArgs e)
{
if (umbraco.helper.GetCurrentUmbracoUser().IsAdmin()==false)
string jcode = "$(document).ready(function(e){$(\"#ctl00_body_TabView1 div.header ul li a:contains('*')\").css(\"display\",\"none\");});";
}
</script>
Open the editcontent.aspx page (located in the umbraco folder) in notepad. Add a register tag to the top of the page.
<%@ Register TagPrefix="tsc" TagName="TabSecurity" Src="../usercontrols/TabSecurity.ascx" %>
Then add the control within the contentplaceholder:
<tsc:TabSecurity runat="Server"/>
Obviously the best option is to get this integrated into the core but should solve your problem in the meantime. I am currently extending this to store the prefix characters in a configuration file for easier management.
-Chris
Good stuff Chirs, thanks! In the true spirit of hacking for the better.
-Paul