Hi,
I have created some dashboards in C#, but the access is not denied to the backoffice users that are supposed to be denied access.
So some of these dashboards should no show up for unauthorised users.
Here is the dashboard code:
[Weight(10)]
public class dashboardMonth : IDashboard
{
public string Alias => "abrioffice_month";
public string View => "/umbraco/backoffice/abrioffice/ABRIOffice/Month";
public string[] Sections => new[] { "abrioffice" };
public IAccessRule[] AccessRules {
get {
var rules = new IAccessRule[] {
new AccessRule() { Type = AccessRuleType.Deny, Value = "manager" },
new AccessRule() { Type = AccessRuleType.Grant, Value = Umbraco.Core.Constants.Security.AdminGroupAlias },
new AccessRule() { Type = AccessRuleType.Deny, Value = Umbraco.Core.Constants.Security.SensitiveDataGroupAlias },
new AccessRule() { Type = AccessRuleType.Deny, Value = Umbraco.Core.Constants.Security.TranslatorGroupAlias },
new AccessRule() { Type = AccessRuleType.Deny, Value = "editor" },
new AccessRule() { Type = AccessRuleType.Grant, Value = "hrAdmin" } };
return rules; } }
}
It's allowing access to all users who have access to any part of that section.
for example:
A user who is part of the 'manger' user group is given access to the month dashboadr even though the rule above specifically denies it.
dashboards not obeying accessrules
Hi, I have created some dashboards in C#, but the access is not denied to the backoffice users that are supposed to be denied access.
So some of these dashboards should no show up for unauthorised users.
Here is the dashboard code:
Any help appreciated.
Nobody?
Damien Holley, peace be upon those who follow guidance.
What are the access rules those not working ?
It's allowing access to all users who have access to any part of that section. for example: A user who is part of the 'manger' user group is given access to the month dashboadr even though the rule above specifically denies it.
I was able to replicate the issue of allowing a denied group with a group alias
manager
too.In contrast, I found it working and deny that group when there is only one rule in that dashboard class.
Currently I don't have visual studio installed yet which allows to debug.
I suggest that you try
package.manifest
file to apply your preferred rules.This will have to be the workaround for now, but it's not good practice or efficient. I will lodge this issue as a bug.
Thanks for the verification.
is working on a reply...