Menu security trimming with areas having same controller names

[Henry]

Hi,

I've noticed that security trimming doesn't work when there's another controller with the same name in another area. We have one extra area currently in use, named "Mobile".

We correctly have the namespaces set up for each route, so the actions work fine otherwise between areas. For example our default route looks like this:

routes.MapRoute(
                "Default",
                "{controller}/{action}/{id}",
                new { controller = "Home", action = "Index", id = UrlParameter.Optional },
                new[] { "MvcApp.Controllers" } //namespace
            );

Example menu:

@(Html.Kendo().Menu()
    .Name("menu")
    .Items(menu => {
        menu.Add().Text("About").Action("About", "Home", new { area = "" });
    }))

Security trimming won't work, unless our Mobile area's HomeController also has that same action (About()). If it's not there, authorize attribute won't work for the menu.

[Georgi Krustev]

Hello Henry,

The described problem is not a known issue. Could you provide more details about your current site structure - controllers/actions/areas? You can try to modify this code library in order to replicate the issue.
Observing the erroneous behavior locally will help us to narrow the problem down much faster and follow you up with more details.

Regards,
Georgi Krustev
Telerik

 

 

[Henry]

Hi Georgi,

I was able to reproduce this issue by making changes to the sample project in this older thread: http://www.telerik.com/forums/menu-does-not-work-with-areas

I added empty HomeController to "MyArea", and then changed the menu to:

@(Html.Kendo().Menu()
 .Name("menu")
 .Items(menu => {
  menu.Add().Text("About").Action("About", "Home", new { area = "" });
}))

Then I decorated the "root" area's About action with [Authorize(Roles = "Admin")].

Security trimming will only work if I then add About action to "MyArea" as well.

To support duplicate controller names, I added the namespace setting to route:

routes.MapRoute(
                "Default",
                "{controller}/{action}/{id}",
                new {controller = "Home", action = "Index", id = UrlParameter.Optional},
                new[] {"MvcApplication4.Controllers"}
                );

[Georgi Krustev]

Hello Henry,

Thank you for the repro steps. I was able to observe the depicted issue. We will further investigate the case and will try to address the problem for the next service pack of Kendo UI due within a month.

Regards,
Georgi Krustev
Telerik

 

 

[Henry]

Hi,

 I was browsing through the release notes in recent versions, and couldn't find this issue mentioned.

 Has this been fixed in current version?

 Thanks...

[Georgi Krustev]

Hello Henry,

I am afraid that we postponed the fix for later Kendo UI release, as there are tasks/bugs with higher priority. The fix is scheduled for Q2 2015 release, but I cannot guarantee whether it will be fixed or not. 

Regards,
Georgi Krustev
Telerik

 

 

[Henry]

Hi,

any news on the fix? I didn't see it mentioned in Q2 release notes.

Thanks again...

[Georgi Krustev]

Hello Henry,

I am afraid that the issue is still not scheduled for implementation. For your convenience, I will post an update here once the issue is fixed.

Regards,
Georgi Krustev
Telerik

 

 

[Georgi Krustev]

Hi,

I moved the issue in our public issue tracker:

https://github.com/telerik/kendo-ui-core/issues/2468

You can follow the progress of the issue there.

Regards,
Georgi Krustev
Telerik by Progress