Forum Discussion

chrigu's avatar
chrigu
Guide
13 years ago

Get Permissions for Categories & Boards

Hi

 

I'm buliding a custom component where the different categories and boards are displayed. Now need to pay attention that normal users don't see all the special categories & boards that are only accessible by a special group of users. Is there a way to retrieve the required permissions from a category or board that are required to see it?

 

I found a solution but there the verifcation is hard-coded into the component. I'd like to verify the permissions of the user against the permissoins that were configured in the administration interface for that board or category.

  • Claudius's avatar
    Claudius
    13 years ago

    Did you give the Rest API already a try? I think if you are using the "rest()" freemarker command instead of "restadmin()" it will take the current user's (or anonymous if viewer of page is not logged in) permissions into account. You might need some error handling though if the user does not have access to that node.

     

    In that regard you might find the examples in this topic relevant for your scenario: http://lithosphere.lithium.com/t5/Developers/Component-Permissions/m-p/38060#M640

  • Claudius's avatar
    Claudius
    Boss
    13 years ago

    Did you give the Rest API already a try? I think if you are using the "rest()" freemarker command instead of "restadmin()" it will take the current user's (or anonymous if viewer of page is not logged in) permissions into account. You might need some error handling though if the user does not have access to that node.

     

    In that regard you might find the examples in this topic relevant for your scenario: http://lithosphere.lithium.com/t5/Developers/Component-Permissions/m-p/38060#M640

    • AdamN's avatar
      AdamN
      Khoros Oracle
      13 years ago

      I agree with Cladius that the best approach would be to setup the permissions as desired and then use the "rest()" freemarker context object. Calls made via the "rest()" freemarker context object are made as the current user and will respect the permissions of that user. If they do not have access to a particular category/board/message, it will not be returned in the result set. With this approach, it will not be necessary to explicitly check roles or permissions in the component.

       

      The "restadmin()" freemarker context object should only be used in very rare circumstances, and proper precautions should be taken when it is used to ensure that content is not accidentally exposed to users that should not have access.