4

We have a separate job for publishing items with some logic. We need to prevent users from accidentally clicking on Publish Site, even Administrators. The regular revoking of 'Publish' item in Core DB doesn't work for Admin.

|improve this question
5

I created a custom Sitecore command to provide more flexible option for this issue.

I looked into the Sitecore code related to system:publish command which was associated with this "Site publish" menu item and adjust it to support few options which can be changed using config setting.

Basically this will provide you with a Sitecore setting which you can adjust by changing config include file, with options to

  1. Run the default sitecore publishing operation
  2. Display a warning message and ignore the publishing
  3. Hide the menu item from Content Editor

Configuration file looks as follows

<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/">
  <sitecore>
    <commands>
      <command type="SitecoreFootsteps.Modules.CustomEditorFullPublishOption.CustomCommand.CustomFullPublish,SitecoreFootsteps.Modules.CustomEditorFullPublishOption" name="scfootsteps:customfullpublish"/>
    </commands>
    <settings>
      <!-- values : 
        enabled : works as default sitecore publishing
        disabled : display warning message and doesn't trigger publishing
        hidden : hide the full publish option
        -->
      <setting name="SitecoreFootsteps.EditorFullPublishOption" value="enabled" />
    </settings>
  </sitecore>
</configuration>

So, if you set the above setting to "hidden", Content Editor "Site publish" option will get hidden

enter image description here

And if you set the setting to "disabled", Content Editor will display "Site publish" option but will return a warning message once clicked and just ignore the publish operation.

enter image description here

You can take a look at the code from following url https://github.com/chaturangar/sitecore-footsteps/blob/master/SitecoreFootsteps.Modules/SitecoreFootsteps.Modules.CustomEditorFullPublishOption/CustomCommand/CustomFullPublish.cs

In that code, just only adjust few places including hiding and displaying message depending on the custom config setting introduced above.

You can find more details from my blog post https://sitecorefootsteps.blogspot.com/2016/11/custom-sitecore-command-to-disable-or.html

|improve this answer
4

You can't hide much for admin users, I would take 2 steps to prevent this happening:

  1. Don't let anyone login as an admin user. Create "CMS Administrator" accounts that have all the access you would need and only ever login to an admin account when there is no other option.

  2. The publish buttons in the CMS that allow a full publish run through the command system:publish. That is defined in the Commands.config as:

If you want to permanently disable the buttons you could override that command so that it doesn't do anything on running the command.

EDIT: New option based on comments

  1. The publish dialog is in /sitecore/shell/Applications/Dialogs/Publish/Publish.xml - it uses Sitecore.Shell.Applications.Dialogs.Publish.PublishForm,Sitecore.Client as the code behind. You could disable the publish buttons in the SheerUI and add some text to inform the user that publishing manually is restricted.
|improve this answer
  • We thought of option 2 but we needed it to be clear for the user that he can't publish the site and not just click it without anything happening. – TamerM Nov 22 '16 at 16:28
  • Regarding option1: does a CMS admin have to lock and edit an item? – TamerM Nov 22 '16 at 16:29
  • Depends on how you set it up. Is that a requirement? – Richard Seal♦ Nov 22 '16 at 16:43
  • @TamerM I have added an extra option based on your first comment. – Richard Seal♦ Nov 22 '16 at 17:00
  • I agree with @RichardSeal here. If you don't trust your administrators not to hit the Publish button, why do they have full admin access that bypasses all workflow and security? Your administrator group definitely needs a review if admins are a problem. – Jason St-Cyr Nov 23 '16 at 13:50
2

Delete the "Publish Site" item under "/sitecore/content/Applications/Content Editor/Menues/Publish" in core DB

|improve this answer
  • It is an option that we are considering and will try it soon. – TamerM Nov 22 '16 at 16:37
  • 1
    As mentioned by Richard, I would suggest to create separate roles for content authors with required set of permissions. In case you provided Admin access to authors to provide ability to edit items without locking, you can do it by setting "RequireLockBeforeEditing" to false so regular authors can edit without locking items. – navincumar Nov 22 '16 at 16:40
  • 1
    I don't think this is a good option. better way is the control this from using user permissions. – scFootsteps Nov 22 '16 at 16:46
  • In this case need was to restrict publish site option to Sitecore Administrators, So permissions wont work. I do agree that, for a regular scenario permissions are better way to control. – navincumar Nov 22 '16 at 17:17
1

You can also check the Publishing Restriction module to restrict bulk publish operation, like if you want to restrict the user to publish home node, Media library etc which contains complete tree, then you can use this module..

https://marketplace.sitecore.net/Modules/S/Sitecore_Publishing_Restriction.aspx?sc_lang=en

|improve this answer
0

I was just looking some publishing-related items and found this details,

Although this has been answered but would like to share some more details.

This is a pretty common requirement and the best way to manage this access through the core DB, Below are some simple steps for the reference.

Step1

enter image description here

Result-

enter image description here

|improve this answer
  • 1
    This will not work for users with Administrator rights since security is ignored for all admin users. – jammykam♦ Dec 7 '17 at 23:58
  • Thanks @jammykam for you input, I have tried for the content editor or custom role, For Administrator user, I do agree this will not work and may need to plan through some custom code. – Jitendra soni Dec 8 '17 at 7:59
0

Apart from the correct answer, we can customize the publish wizard, override Default Sitecore PublishForm class and check for the current logged in user in override void OnNext method and show custom message to the content author with custom alert message saying 'You do not have access. Please contact administrator' instead of disabling the whole publishing button.

You can find more information on how to customize publishing in the blog link

https://blog.horizontalintegration.com/2017/12/05/how-to-override-sitecore-publish-wizard-form/

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.