Writer is able to publish by using "Release Date" even if they don't have perms to publish.
Hi All,
I've run into the bug where a writer who does not have access to publish a node can simply put a date in the "Release Date" field and the node will publish at that date/time. I decided to circumvent this by writing a BeforeSave method that checks if the user is a writer and, if so, sets sender.ReleaseDate back to DateTime.MinValue (it also checks to see a date wasn't already in the doc, so as not to overwrite one a publisher put there).
public UmbracoEventExtender() { Document.BeforeSave += new Document.SaveEventHandler(Document_BeforeSave); }
// Ensuring that a writer cannot save a Release or Expire date for a node. There is a bug // in Umbraco that allows the node to be published when a writer sets the Publish date. if (umbraco.helper.GetCurrentUmbracoUser().UserType.Alias == "writer") {
// Checking to see if a publish date had already been set on the node. We don't want to undo // a publish date set by a publisher Document doc = new Document(sender.Id);
Thing is, it's not working. I've read that there's also a bug in Umbraco such that the ReleaseDate and other properties get persisted to the database before this code is even hit, making my code useless. Is there another way around this issue? This part of the workflow is pretty important. Is there a way to hide the Release and Expire dates from writers?
Of course, if anyone knows what they're doing with FireBug they could easily add a value to the hidden field. Not really an issue in my case, so this will do for now.
Writer is able to publish by using "Release Date" even if they don't have perms to publish.
Hi All,
I've run into the bug where a writer who does not have access to publish a node can simply put a date in the "Release Date" field and the node will publish at that date/time. I decided to circumvent this by writing a BeforeSave method that checks if the user is a writer and, if so, sets sender.ReleaseDate back to DateTime.MinValue (it also checks to see a date wasn't already in the doc, so as not to overwrite one a publisher put there).
Thing is, it's not working. I've read that there's also a bug in Umbraco such that the ReleaseDate and other properties get persisted to the database before this code is even hit, making my code useless. Is there another way around this issue? This part of the workflow is pretty important. Is there a way to hide the Release and Expire dates from writers?
Thanks,
Jay
As a work-around I've added the following to /mycmsdir/umbraco/editcontent.aspx in a script block:
Of course, if anyone knows what they're doing with FireBug they could easily add a value to the hidden field. Not really an issue in my case, so this will do for now.
Thanks,
Jay
is working on a reply...