lsm/Orchard
1
0
Fork 0
mirror of https://github.com/OrchardCMS/Orchard.git synced 2025-10-15 03:25:23 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

16975 ItemController.Preview action in contents module should do permission demand for edit content

Browse Source 
--HG--
branch : dev
This commit is contained in:
Suha Can
2010-12-08 17:48:40 -08:00
parent 42a8e39478
commit d8a02d4f3e
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/Orchard.Web/Core/Contents/Controllers/ItemController.cs
View File

@@ -1,6 +1,7 @@
using System.Web.Mvc;
using Orchard.ContentManagement;
using Orchard.DisplayManagement;
using Orchard.Localization;
using Orchard.Themes;
namespace Orchard.Core.Contents.Controllers {
@@ -8,12 +9,16 @@ namespace Orchard.Core.Contents.Controllers {
public class ItemController : Controller {
private readonly IContentManager _contentManager;
public ItemController(IContentManager contentManager, IShapeFactory shapeFactory) {
public ItemController(IContentManager contentManager, IShapeFactory shapeFactory, IOrchardServices services) {
_contentManager = contentManager;
Shape = shapeFactory;
Services = services;
T = NullLocalizer.Instance;
}
dynamic Shape { get; set; }
public IOrchardServices Services { get; private set; }
public Localizer T { get; set; }
// /Contents/Item/Display/72
public ActionResult Display(int id) {
@@ -31,6 +36,10 @@ namespace Orchard.Core.Contents.Controllers {
versionOptions = VersionOptions.Number((int)version);
var contentItem = _contentManager.Get(id, versionOptions);
if (!Services.Authorizer.Authorize(Permissions.EditOthersContent, contentItem, T("Cannot edit content")))
return new HttpUnauthorizedResult();
dynamic model = _contentManager.BuildDisplay(contentItem);
// Casting to avoid invalid (under medium trust) reflection over the protected View method and force a static invocation.
return View("Display", (object)model);