Can&#39;t open user Portrait

A critical vulnerability was discovered in React Server Components (Next.js). Our systems remain protected but we advise to update packages to newest version. Learn More.

AI OnAI Off

Home / Forums / Legacy forums / Episerver Relate+ /

Can't open user Portrait

Oleh Ilnitskiy

Vote:

Hello! I am trying to open user Portrait in new tab using given url:

var image = user.GetPortraitUri(ImageSize.Huge).ToString();

result:

http://localhost:18000/EPiServerCommunity/Modules/ImageGallery/ImageHandler.ashx?imageId=1&thumbnailId=1

here is part of my EpiServerCommunity section:

<location path="EPiServerCommunity">
    <system.web>
      <pages enableViewState="true"/>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

and

 <location path="EPiServerCommunity/Modules/ImageGallery/ImageHandler.ashx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <location path="EPiServerCommunity/Images">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

When I am trying to open image using url it redirect me to EpiServer login page. I dont understan why. Because I have allow users="*"

Any ideas ?

#113001

Nov 10, 2014 13:30

Oleh Ilnitskiy

Vote:

Resolved my problem. EPiServer skips permitions in location section. I created class CommunitySecurityModule with event MyPageHandler_Register where I set Owner to ImageGallery and other AccessRights for newsfeed and etc. Now when I had registered user and added it to System  <pre class="brush:csharp;auto-links:false;toolbar:false" contenteditable="false">newUser = CommunitySystem.CurrentContext.DefaultSecurity.AddUser(newUser);</pre> it calls MyPageHandler_Register and sets all rights: <pre class="brush:csharp;auto-links:false;toolbar:false" contenteditable="false">var user = e.Object as IUser; if (user != null) { var myPage = MyPageHandler.Instance.GetMyPage(user); if (myPage != null && myPage.ImageGallery != null) { foreach (var imageGallery in myPage.ImageGallery.Children) { var imageGalleryClone = imageGallery.CreateWritableClone() as ImageGallery; imageGalleryClone.SetOwner(user); ImageGalleryHandler.Instance.UpdateImageGallery(imageGalleryClone); } } }</pre> Implementation of SetOwner method below: <pre class="brush:csharp;auto-links:false;toolbar:false" contenteditable="false"> public static void SetOwner(this ImageGallery imageGallery, IUser owner) { imageGallery.SetAttributeValue("Owner", owner); }</pre> Note: Before that you should create Attribute "Owner" for ImageGallery of type IUser in admin panel.

#113123

Nov 13, 2014 12:25

Oleh Ilnitskiy

Vote:

Implementation of <code>DefaultSecurity_CreatedUser</code>: <pre class="brush:csharp;auto-links:false;toolbar:false" contenteditable="false">private void DefaultSecurity_CreatedUser(ISecurityHandler sender, ICreateUserEventArgs args) { // Add user to the community members group var group = CommunityMembersGroup; var addedUser = args.User; addedUser = (IUser)addedUser.CreateWritableClone(); addedUser.Groups.Add(group); // Update the user CommunitySystem.CurrentContext.DefaultSecurity.UpdateUser(addedUser); // Set access rights to the newly created user // Access right for anonymous users var anonAccessRights = new ReadModifyRemoveAccessRights { Read = true, }; EntitySecurityHandler.Instance.SetAccessRights(addedUser, AnonymousGroup, anonAccessRights); // Access right for community members var communityMembersAccessRights = new ReadModifyRemoveAccessRights { Read = true, }; EntitySecurityHandler.Instance.SetAccessRights(addedUser, group, communityMembersAccessRights); // Access rights for administrators var adminAccessRights = new ReadModifyRemoveAccessRights { Read = true, Modify = true, Remove = true }; EntitySecurityHandler.Instance.SetAccessRights(addedUser, AdministratorsGroup, adminAccessRights); // Access rights for the added user var userAccessRights = new ReadModifyRemoveAccessRights { Read = true, Modify = true, Remove = true }; EntitySecurityHandler.Instance.SetAccessRights(addedUser, addedUser, userAccessRights); // Access rights for moderator var moderatorAccessRights = new ReadModifyRemoveAccessRights { Read = true, Modify = true, Remove = true }; EntitySecurityHandler.Instance.SetAccessRights(addedUser, ModeratorsGroup, moderatorAccessRights); }</pre>

#113131

Nov 13, 2014 14:47

This thread is locked and should be used for reference only. Please use the Legacy add-ons forum to open new discussions.