/BlogEngine/DotNetSlave.BusinessLogic/Security/SecuritySiteMapProvider.cs

 1namespace BlogEngine.Core
 2{
 3    using System;
 4    using System.Collections.Generic;
 5    using System.Linq;
 6    using System.Text;
 7    using System.Web;
 8
 9    /// <summary>
10    /// Implementation of the XmlSiteMapProvider that is Rights aware.
11    /// </summary>
12    public class SecuritySiteMapProvider : XmlSiteMapProvider
13    {
14        /// <summary>
15        /// Returns whether the SiteMapNode is accessible to the current user.
16        /// </summary>
17        public override bool IsAccessibleToUser(HttpContext context, SiteMapNode node)
18        {
19            // We are checking Rights, and other custom attributes here.
20            // Roles may also be part of the SiteMapNode.  Let the base class
21            // check for that.  If false, return false, otherwise, continue
22            // with our checks.
23
24            if (!base.IsAccessibleToUser(context, node))
25                return false;
26
27            bool primaryBlogInstanceOnly;
28            if (!string.IsNullOrWhiteSpace(node["primaryBlogInstanceOnly"]) && bool.TryParse(node["primaryBlogInstanceOnly"], out primaryBlogInstanceOnly))
29            {
30                if (primaryBlogInstanceOnly && !Blog.CurrentInstance.IsPrimary)
31                {
32                    return false;
33                }
34            }
35
36            if (!Utils.StringIsNullOrWhitespace(node["rights"]))
37            {
38                // By default, all specified Rights must exist.
39                // We allow this to be overridden via the "rightsAuthorizationCheck"
40                // attribute.
41
42                AuthorizationCheck authCheck = AuthorizationCheck.HasAll;
43                if (!Utils.StringIsNullOrWhitespace(node["rightsAuthorizationCheck"]))
44                {
45                    authCheck = Utils.ParseEnum<AuthorizationCheck>(node["rightsAuthorizationCheck"], AuthorizationCheck.HasAll);
46                }
47
48                string[] rightsRaw = node["rights"].Split(new char[] { ';', ',' }, StringSplitOptions.RemoveEmptyEntries);
49
50                List<Rights> rightsToCheck = new List<Rights>();
51                foreach (string r in rightsRaw)
52                {
53                    Rights right = Utils.ParseEnum<Rights>(r.Trim(), Rights.None);
54                    if (right != Rights.None)
55                        rightsToCheck.Add(right);
56                }
57
58                if (rightsToCheck.Count > 0)
59                {
60                    return Security.IsAuthorizedTo(authCheck, rightsToCheck.ToArray());
61                }
62            }
63
64            return true;
65        }
66    }
67}