[Solved] Problems with securityTrimmingEnabled="false"

[Victor]

Hi!

I'm using the Menu component bound to a sitemap provided by the MvcSiteMapProvider (http://mvcsitemap.codeplex.com/). The problem that I have that even if securityTrimmingEnabled="false" all menu links to pages that require authorization are removed. Attached is a small project that demonstrates this behaviour. Have I missed something configuration-wise or is there some other problem?

In the project, the first dropdown menu ("Home") should have two items ("Home" and "About") - only Home is shown. When removing [Authorize] over the About action inside HomeController everything looks as it is supposed to.

Another question: Why are empty parents left in the menu? Is there any way to turn that off? Scenario: In the test project a container menu item is added around the About link - with securityTrimmingEnabled="true" the About menu disappears, however the container will remain even though it doesnt lead anywhere (no action, url, etc. specified => not clickable).

Kind regards
Victor Ström

[Georgi Krustev]

Hello Victor,

Currently SecurityTrimming is enabled by default. I will suggest you use Url.Action in order to build URL. Then you can set it to the item using Url() method:

item.Url(Url.Action(node.Action, node.Controller, new { area = node.Area }));

Regards,
Georgi Krustev
the Telerik team

[Victor]

Thanks for that! A bit counter-intuitive though that setting the link with Url() respects the security trimming setting while and setting it with Action() does not. Is that really the intended behaviour?

There is also still the issue with the visible container. Changing the sitemap code to:

<?xml version="1.0" encoding="utf-8" ?>
<mvcSiteMap xmlns="http://mvcsitemap.codeplex.com/schemas/MvcSiteMap-File-3.0" enableLocalization="true">
  <mvcSiteMapNode title="Root" clickable="false" changeFrequency="Always" updatePriority="Normal" key="Home">
    <mvcSiteMapNode title="Home" controller="Home" clickable="false" >
      <mvcSiteMapNode title="Home" action="Index" />
      <mvcSiteMapNode title="TestContainer" clickable="false">
        <mvcSiteMapNode title="About" action="About" />
      </mvcSiteMapNode>
    </mvcSiteMapNode>
  </mvcSiteMapNode>
</mvcSiteMap>

and setting securityTrimmingEnabled="true" will show the TestContainer option even thought it's not clickabe and also does not have any children.

/Victor

[Georgi Krustev]

Hello Victor,

Our SiteMapProvider always uses SecurityTrimming irrelevant to the user's choice.

Currently .Action() always check if the generated URL is accessible or not. .URL() in other hand allows to set cross-domain URLs that is why it does not check if the URL is accessible. 

If you need to turn on/off security trimming you will need to use one of these methods.

Regards,

Georgi Krustev
the Telerik team

[Victor]

Ok, thanks for the explanation.

What about the visible non-clickable container with no children as in the sitemap example above? Is there any way to hide that container?

/Victor

[Georgi Krustev]

Hello Victor,

 
You can use item.Visible property to hide some of the items.
For instance you can hide About item like so:

.ItemDataBound((item, node) =>
                                {
                                    item.Text = node.Title;
                                    if (!string.IsNullOrEmpty(node.Action))
                                    {
                                        item.Url(Url.Action(node.Action, node.Controller, new { area = node.Area }));
                                    }
                                    if (!node.HasChildNodes)
                                    {
                                        item.Visible = false;
                                    }
                                })

Regards,
Georgi Krustev
the Telerik team

[Victor]

Ok, thanks a lot!

(Although for anyone else reading this there should be an "else" before the last if clause. Otherwise ALL leaf nodes are hidden :)  )

/Victor