[Solved] RadEditorProvider For DNN

[johnv]

Hey Community,

I just wanted to pop in to see if anyone else has experienced an issue with Module Editors not having permissions to upload a file to the File System using the image editor (or other editor popups). We have been looking at this on our upgrade environment for our corporate intranet.

It seems that there is a deficiency in the (App_Code/TelerikWebUI/)RadEditorProvider.vb file that only allows READ permissions for module editors. So, unless you are an administrator you can't upload files. Seems to me that if you have access to an "Edit control" at all, you should be able to upload files to the file system.

Also the code simply throw's an error stating that you don't have permissions! I would imagine that Telerik may want to revisit this module simply because it doesn't have a nicer error page for end users, but really, I would challenge their thinking about how they are allowing access.

As for my time line,

I changed the bold line of code below. It works for now, and I can go back and re-factor it once our roll out is completed.

        Private Function CheckPermissions(ByVal virtualPath As String, ByVal permissions As Telerik.Web.UI.Widgets.PathPermissions) As Boolean
            If String.IsNullOrEmpty(virtualPath) Then
                Return False
            End If

            Dim fPermissions As Telerik.Web.UI.Widgets.PathPermissions
            Dim path As String = Context.Server.MapPath(virtualPath)
            Dim PortalSettings As DotNetNuke.Entities.Portals.PortalSettings = DotNetNuke.Entities.Portals.PortalController.GetCurrentPortalSettings()
            If Directory.Exists(path) Then
                If (PortalSettings.ActiveTab.ParentId = PortalSettings.SuperTabId) Then
                    path = path.Substring(DotNetNuke.Common.Globals.HostMapPath.Length)
                Else
                    path = path.Substring(PortalSettings.HomeDirectoryMapPath.Length)
                End If
                Dim fixedPath As String = path.Replace("\", "/").TrimEnd(New Char() {"/"c}) & "/"
                Dim writeRoles As String = FileSystemUtils.GetRoles(fixedPath, PortalSettings.PortalId, "WRITE")
                If (PortalSecurity.IsInRoles(writeRoles)) Then
                    fPermissions = fPermissions Or Telerik.Web.UI.Widgets.PathPermissions.Upload Or Widgets.PathPermissions.Delete
                End If
                Dim readRoles As String = FileSystemUtils.GetRoles(fixedPath, PortalSettings.PortalId, "READ")
                If (PortalSecurity.IsInRoles(readRoles)) Then
                    fPermissions = fPermissions Or Telerik.Web.UI.Widgets.PathPermissions.Read Or Telerik.Web.UI.Widgets.PathPermissions.Upload
                End If
            End If
            Return (fPermissions And permissions) > 0
        End Function

The bottom line is that I extended the Read permissions to include Upload permissions. The administrators are still the only people who have access to delete files from the file system and my module editors can upload files system wide now.

As for re-factoring the code, I plan to change this function to see if the parent page is an edit page, then allow uploads. I think that there is wisdom in granting delete privileges to administrators only - for my company anyway...

I hope that this post can help someone in some way. Also, as always, if I am missing something and there is a way to handle this without changing code could someone please point it out to me? I would absolutely welcome any constructive feedback with regard to this work around.

Kind Regards,

John

[johnv]

Okay, so as it turns out, my code modification was unnecessary. The File Manager under the admin menu has additional file permissions that must be set up for the images (and other) folders in order for the upload to work correctly.

Please disregard (or delete) this thread as I don't want to lead someone down the wrong path.

Thanks!

John