Permission error in Image Manager when accessing SiteCollectionImages

24 posts, 0 answers
  1. starke
    starke avatar
    10 posts
    Member since:
    May 2007

    Posted 27 Dec 2007 Link to this post

    Hi,

        Our client just reported a strange problem when trying to access SiteCollectionImages from Image Manager. Whenever a user tries to open the Image Manager, a SharePoint permission denied page will be displayed. We've checked that the site collection images and the local site's publishing images has the appropriate permissions, but to no avail.

        After some trial and error, we've found that the parent site of the current site requires the user to have contribute permission to resolve the issue. For example, /home/site1/subsite1. "site1" requires the user to have contribute permission here so that he/she can use Image manager in subsite1

        Our ConfigFile.xml
       
    <configuration> 
      <property name="AllowScripts">True</property> 
      <property name="AllowThumbGeneration">True</property> 
      <property name="ConvertToXhtml">True</property> 
      <property name="EnableDocking">False</property> 
      <property name="ShowHtmlMode">True</property> 
      <property name="ShowPreviewMode">False</property> 
      <property name="StripAbsoluteAnchorPaths">False</property> 
      <property name="StripAbsoluteImagesPaths">True</property> 
      <property name="ToolbarMode">ShowOnFocus</property> 
      <property name="ToolsWidth">800px</property> 
      <property name="MaxImageSize">2097152</property> 
      <property name="CssFiles"
        <item>/Style Library/en-us/Core Styles/RadEditorStyle.css</item> 
      </property> 
        <property name="ImagesPaths"
        <item>SiteCollectionImages</item>    
        <item>PublishingImages</item> 
      </property> 
      <property name="ImagesFilters"
            <item>*.gif</item> 
            <item>*.jpg</item> 
            <item>*.jpeg</item> 
            <item>*.png</item> 
            <item>*.bmp</item> 
      </property> 
       <property name="Language">en-GB</property> 
     
    </configuration> 


        Another note is that if we remove the "SiteCollectionImages" from the ImagePath in the ConfigFile.xml, the user will be able to access the Image Manager properly and doing vice vesa, user will not be able to access Image Manager when there's only SiteCollectionImages in the path. I've also tried upgrading the radeditor to 4.4.1 (currently using 3.4.2), but it did not solve the problem.

        Anybody has any idea on what could be wrong as we can't possibly give everybody contribute rights on every site.


    Thanks & Regards.
    JK

       
  2. Lini
    Admin
    Lini avatar
    2144 posts

    Posted 28 Dec 2007 Link to this post

    Hello JK,

    Can you give us some more details about the error? A stack trace will be very useful so we can determine what causes the exception. I assume that you have already given contribute permissions for the Site Collection Images library itself and the problem disappears only when you give contribute permissions for the entire parent site. I suspect that the problem is in the code we use to verify whether the library exists.

    Best wishes,
    Lini
    the Telerik team

    Instantly find answers to your questions at the new Telerik Support Center

  3. starke
    starke avatar
    10 posts
    Member since:
    May 2007

    Posted 30 Dec 2007 Link to this post

    Hi Lini,

    Thank you for your reply.

    Yes, you are right. Currently, the Image Manager functioned properly when we give full permission to the user in the parent site. We have advised our client to remove the "SiteCollectionImages" path item currently, as this will retain the permission in their huge site collection.

    Unfortunately, I've checked through the Event Viewer and SharePoint logs in the 12 hive, and they did not produce any errors / warnings regarding the problem. Is there other ways to generate useful logs from RadEditor Moss?

    Happy New Year!

    Thanks & Regards.
    Ji Kai


  4. Lini
    Admin
    Lini avatar
    2144 posts

    Posted 02 Jan 2008 Link to this post

    Hi Ji Kai,

    If you can reproduce the problem, then you can temporary turn off the SharePoint custom errors (http://blogs.msdn.com/scaravajal/archive/2007/11/27/sharepoint-debugging-and-feature-implementation.aspx). This way you will be able to see the error details in the image manager popup itself.

    I will try to set up a test server with the described config to see if I can get the error as well.

    Best wishes,
    Lini
    the Telerik team

    Instantly find answers to your questions at the new Telerik Support Center
  5. starke
    starke avatar
    10 posts
    Member since:
    May 2007

    Posted 02 Jan 2008 Link to this post

    Hi Lini,

        Thank you for your reply.

        I've tried turning off the custom error page previously. The result page is a SharePoint default "access is denied" page and no other information is provided.

        Maybe to further assist you in your test, our permissions settings goes like this:

        Groups
        GroupA
        GroupB (group b users are not in group A)

        Site Permissions
        http://SiteA   -   Group A (contribute), Group B (none)
        http://SiteA/SiteA1 - Group B(contribute) - the Problem site


        One more thing, i've just done a simple test by going directly to the Site Collection Image library and give explicit contribute permission to the user and it's still the same. It seems that the user must have contribute permission in the root site specifically to access Site Collection Images in the Image Manager.

        Hope I can be of some help. Awaiting your reply.


    Best Wishes!
    Ji Kai

  6. Lini
    Admin
    Lini avatar
    2144 posts

    Posted 03 Jan 2008 Link to this post

    Hello Ji Kai,

    I just finished testing the latest editor for MOSS with the following scenario:

    User A has contribute permissions only in the Site Collection Images list in SiteA and contribute permissions for the whole SiteB. SiteB is a sub-site of SiteA. The ImagesPaths was set as follows:

    <property name="ImagesPaths">
        <item>SiteCollectionImages</item>
    </property>

    Using these settings, the Image Manager opened with no error. I will do some more tests/add more libraries in the images paths to see if I can reproduce the error.

    Regards,
    Lini
    the Telerik team

    Instantly find answers to your questions at the new Telerik Support Center
  7. starke
    starke avatar
    10 posts
    Member since:
    May 2007

    Posted 31 Jan 2008 Link to this post

    Hi Lini,

        Wonder if you are able to reproduce the problem?


    Regards.
    Ji Kai
  8. Lini
    Admin
    Lini avatar
    2144 posts

    Posted 01 Feb 2008 Link to this post

    Hello Ji Kai,

    Unfortunately, I did not manage to produce the error. However, we have released an updated version of the RadEditor for MOSS (v4.50). The new release includes a couple of changes to the file browser content provider and more specifically - opening document libraries from the site collection. If you can, update to the new release and see if the image manager will open now.

    Sincerely yours,
    Lini
    the Telerik team

    Instantly find answers to your questions at the new Telerik Support Center
  9. AAron
    AAron avatar
    6 posts
    Member since:
    Sep 2006

    Posted 03 Feb 2008 Link to this post

    I just installed the free RadEditorMOSS_4_5_0.zip on a new MOSS farm (no other third party components installed), and I get this error.

    I have a MOSS 2007 portal (/) that my user doesn't have access to.
    I create sites under "/SiteDirectory".
    I created "/SiteDirectory/fam" as a Wiki (my user has full admin access to it).
    I installed and activated (as domain administrator):
        Use RadEditor to edit List Items
        Use RadEditor to edit List Items in Internet Explorer as well
    I had to do iisreset to have the new RTE appear.

    When I go to the main Home page, click Edit, then click Image Manager, I get the following error:
    Go back to site

    Error: Access Denied


    Current User
    You are currently signed in as:  HOME\abcdefg
     
    Sign in as a different user

    There is no 12/logs entry for it.
    The IIS log file shows this close to that timeframe:

    2008-02-04 02:33:38 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/toolOverBg.gif - 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0
    2008-02-04 02:33:38 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/DialogueHeaderLeft.gif - 80 - 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 401 2 2148074254
    2008-02-04 02:33:38 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/DialogueHeaderLeft.gif - 80 - 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 401 1 0
    2008-02-04 02:33:39 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/DialogueHeaderLeft.gif - 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0
    2008-02-04 02:33:39 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/dialogueHeaderClose.gif - 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0
    2008-02-04 02:33:39 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Skins/Default2006/CssImg/footerResize.gif - 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0
    2008-02-04 02:33:39 W3SVC1618006552 192.168.1.10 GET /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Dialog.aspx dialog=ImageManager&editorID=ctl00_m_g_97779892_b33b_4b04_a14e_7ce16ae2db80_ctl00_ctl05_ctl01_ctl00_ctl00_ctl04_ctl00_ctl00_RadTextField&useSession=0&sessionID2=2aee57b1-d0e3-3d24-89de-72607dc68e40&language=en_US&UseEmbeddedScripts=yes 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0
    2008-02-04 02:33:42 W3SVC1618006552 192.168.1.10 GET /SiteDirectory/fam/_layouts/AccessDenied.aspx - 80 - 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 401 1 0
    2008-02-04 02:33:42 W3SVC1618006552 192.168.1.10 POST /_wpresources/RadEditorSharePoint/4.5.0.0__1f131a624888eeed/RadControls/Editor/Dialog.aspx dialog=ImageManager&editorID=ctl00_m_g_97779892_b33b_4b04_a14e_7ce16ae2db80_ctl00_ctl05_ctl01_ctl00_ctl00_ctl04_ctl00_ctl00_RadTextField&useSession=0&sessionID2=2aee57b1-d0e3-3d24-89de-72607dc68e40&language=en_US&UseEmbeddedScripts=yes 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 302 0 0
    2008-02-04 02:33:42 W3SVC1618006552 192.168.1.10 GET /SiteDirectory/fam/_layouts/AccessDenied.aspx - 80 home\abcdefg 192.168.1.1 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+Tablet+PC+1.7;+.NET+CLR+1.0.3705;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+InfoPath.1) 200 0 0


  10. AAron
    AAron avatar
    6 posts
    Member since:
    Sep 2006

    Posted 03 Feb 2008 Link to this post

    starke is right.

    I gave home\abcdefg visitor access to the portal, still got the error.
    I gave home\abcdefg member access to the portal, the image manager worked.

    I obviously don't want to have the users have member access to the portal...
  11. AAron
    AAron avatar
    6 posts
    Member since:
    Sep 2006

    Posted 07 Feb 2008 Link to this post

    Are you still following this thread?

    I've got a simple setup, so I hope my information is helping you resolve the current problem with the product.
  12. Alvin
    Alvin avatar
    10 posts
    Member since:
    Jul 2006

    Posted 11 Feb 2008 Link to this post

    Hi AAron,

        I've installed version 4.5.0.0 of the RadEditor and it seems to have solved the problem on my development machine. I'm getting my client to test it in their environment to see whether it rectify the problem. Will let you know again if it does, if not, we'll need Lini's help then =)


    Regards.
    Ji Kai
  13. AAron
    AAron avatar
    6 posts
    Member since:
    Sep 2006

    Posted 19 Feb 2008 Link to this post

    So did it solve the problem?

    My out-of-the-box setup + /SiteDirectory/Wiki (as described above) still can't access the Image Manager without special permissions in the portal.
  14. AAron
    AAron avatar
    6 posts
    Member since:
    Sep 2006

    Posted 21 Feb 2008 Link to this post

    This is the "Hack" solution I enacted to allow the ImageManager to work while providing minimal permissions to the portal...

    I have RadEditorMOSS_4_5_0.zip on a new MOSS farm (no other third party components installed).
    I create sites under "/SiteDirectory", and I created "/SiteDirectory/fam" as a Wiki (my users have member/contributer access to it).

    With no other changes, clicking on Image Manager produces:

    Error: Access Denied

    To "Fix" this, I created a Permission Level "RadEditor ImageManager" (from /_layouts/role.aspx). I gave that permission level permission to "Browse Directories," "View Pages" and "Open," all under "Site Permissions."
    Then I created a Group called "RadEditor ImageManager," and gave it Permission "RadEditor ImageManager." Then I added "NT Authority\authenticated users" to the "RadEditor ImageManager" group.

    This "hack" doesn't allow normal portal viewing access, but I'm concerned about what it actually does give the user access to... such as browsing through the portal's "All Site Content" directory (/_layouts/viewlsts.aspx).

    The "hack" does provide all users with enough read permissions to use the ImageManager. The downside is that "/Documents," "/Pages," and "/PublishingImages" from the portal all appear in the list, but appear empty and unwriteable. My new Libraries "/SiteDirectory/Fam/UploadedImages" and "/SiteDirectory/Fam/Wiki Pages" do appear and work fine.

    I hope this helps people with this fantastic control while Telerik attempts (hopefully) to duplicate and fix the problem.
  15. starke
    starke avatar
    10 posts
    Member since:
    May 2007

    Posted 22 Feb 2008 Link to this post

    Hi AAron,

        The new version of RadEditor did solve the problem, as least for my Publishing Site. The Image Manager do not have user permission problems anymore, but it caused another problem for us (http://www.telerik.com/community/forums/thread/b311D-bcceda.aspx), which may not be applicable to you.


    Regards.
    Ji Kai
  16. Marvin
    Marvin  avatar
    1 posts
    Member since:
    Mar 2008

    Posted 03 Mar 2008 Link to this post

    Any other ideas to solve this problem ? Having the same problems and I am on 4.4.1.0.

  17. WantToKnow
    WantToKnow avatar
    4 posts
    Member since:
    Feb 2008

    Posted 08 Oct 2010 Link to this post

    Hi,

    We are on 4.5.1.0, a higher version that the one reported in this linked article but we still face this problem. Was wondering what was the minimum privilege required for users from parent's site in order not to encounter SharePoint permission denied page when selecting images from Image Manager.

    We tried granting the user to visitor to parent's site but still encounter access denied page. It's only when granted with contribute permission, then they can access Image Manager without permission error.

    Appreciate your advise.
    Thanks!

  18. Stanimir
    Admin
    Stanimir avatar
    1653 posts

    Posted 11 Oct 2010 Link to this post

    Hi WantToKnow,

    The minimal permissions are Read. In this case the user will be only able to insert images in the content. He will not be able to upload, delete images. In addition the user must has Read permissions for the current library and all its parent libraries as well.

    Sincerely yours,
    Stanimir
    the Telerik team

    Check out Telerik Trainer, the state of the art learning tool for Telerik products.
  19. WantToKnow
    WantToKnow avatar
    4 posts
    Member since:
    Feb 2008

    Posted 12 Oct 2010 Link to this post

    Hi Stanimir,

    The user (Jane) accessing the subsite (SiteA1) has READ permission from it's parent site (SiteA). But was still faced with access denied when (Jane) access Image Manager from it's subsite (SiteA1). Yes, (Jane) has READ permissions in parent(SiteA)library and was granted FULL permission in it's subsite including it's images library (SiteA1).

    (Jane) is in SiteA Visitors group in SiteA (Parent)
    and SiteA1 Owners in SiteA1(subsite)

    Ie.
    http://SiteA        -  Permission Group: SiteA Visitors (Read)
    http://SiteA/SiteA1 - Permission Group: SiteA1 Owners (Full permission)

    Appreciate your advise, Thanks!

  20. Stanimir
    Admin
    Stanimir avatar
    1653 posts

    Posted 13 Oct 2010 Link to this post

    Hello WantToKnow,

    I tested the issue with the latest RadEditor for MOSS, which now is 5.8.2. What I suggest to you is upgrade to it. You can find the upgrade instructions in the following online help article: Upgrade Instructions from version 4.x to version 5.x

    We offer a fully-featured trial version of the RadEditor for MOSS v5. It has everything from the paid commercial version and the only difference is that it randomly displays a license message when the editor loads. You can download the trial from the RadControls for ASP.NET AJAX trials page on our site.


    Sincerely yours,
    Stanimir
    the Telerik team

    Check out Telerik Trainer, the state of the art learning tool for Telerik products.
  21. WantToKnow
    WantToKnow avatar
    4 posts
    Member since:
    Feb 2008

    Posted 17 Oct 2010 Link to this post

    Hi Stanimir,

    Am I right to say the behavior that I encountered is happening in my current version, 4.5.1.0 ? And that upgrading to the version you mention will prevent the error I'm facing now?

    Appreciate your advise.
    Thanks!
  22. Stanimir
    Admin
    Stanimir avatar
    1653 posts

    Posted 19 Oct 2010 Link to this post

    Hello WantToKnow,

    In the ASP.NET AJAX version of the control, if the user has read permissions, he will be able to see the contents of the library. However he will not be able to upload or delete files.


    Sincerely yours,
    Stanimir
    the Telerik team

    Check out Telerik Trainer, the state of the art learning tool for Telerik products.
  23. WantToKnow
    WantToKnow avatar
    4 posts
    Member since:
    Feb 2008

    Posted 26 Oct 2010 Link to this post

    Hi Stanimir,

    User has read permission as described in scenario below, but was still faced with access denied when accessing image manager icon at telerik editor. My concern was, what is the minimum privilege required for users from parent's site in order not to encounter SharePoint permission denied page when selecting images from Image Manager.

    Scenario:

    The user (Jane) accessing the subsite (SiteA1) has READ permission from it's parent site (SiteA). But was still faced with access denied when (Jane) access Image Manager from it's subsite (SiteA1). Yes, (Jane) has READ permissions in parent(SiteA)library and was granted FULL permission in it's subsite including it's images library (SiteA1).

    (Jane) is in SiteA Visitors group in SiteA (Parent)
    and SiteA1 Owners in SiteA1(subsite)

    Ie.
    http://SiteA        -  Permission Group: SiteA Visitors (Read)
    http://SiteA/SiteA1 - Permission Group: SiteA1 Owners (Full permission)

    Appreciate your advise, thanks!

  24. Stanimir
    Admin
    Stanimir avatar
    1653 posts

    Posted 28 Oct 2010 Link to this post

    Hello WantToKnow,

    If you are using the latest version of RadEditor, which now is 5.8.2, please open an official support ticket. We will investigate it and advise you further.


    Greetings,
    Stanimir
    the Telerik team

    Check out Telerik Trainer, the state of the art learning tool for Telerik products.
Back to Top