Due to a recent mishap, our client is requesting that when a Content Author tries to edit an item we first check to see if the item is used as a datasource for any items that the Content Author does not have permission to edit, and deny editing (write/delete/rename) permissions if so.
Does anyone know a good way to do this?
Note: I added my working idea as a possible solution, but I'm not super happy with it right now. It's a lot of effort and I am very concerned about the performance toll that it will take.
In the Sitecore architecture at a site level, there are two locations where I store rendering datasources:
- Page Content Library (PCL): under the page item; page-specific datasources that are not used by any other page
- Shared Content Library (SCL): under the site item; site-specific datasources that can be shared by renderings on multiple pages
Visual Example of the Issue
Consider the following Sitecore tree structure:
|- MySite |--+- Global Settings |--+- Shared Content Library |--|--+- Banners |--|--+- Headlines |--|--+- Callouts |--|--|--+- My Shared Callout * Dynamically deny permissions to this item |--|--+- ... |--+- Home * "My Shared Callout" used; no edit permissions |--|--+- Page Content Library |--|--|--+- Banners |--|--|--+- Headlines |--|--|--+- Callouts |--|--|--+- ... |--|--+- About * shared datasource used; has edit permissions |--|--|--+- Page Content Library |--|--|--|--+- Banners |--|--|--|--+- Headlines |--|--|--|--+- Callouts |--|--|--|--+- ... |--|--+--+- ...
Note that the callout component, "My Shared Callout", is shared by a rendering on both the
Home page item and the
About page item. Note also that in this example, the specific content author doesn't have permission to edit the
Home page item but does have permission to edit the
About page item.
In this example, in order to allow the Content Author to edit all of the content for the
About item, he must have permission to edit shared datasource content in the
Shared Content Library. However, if a particular datasource is used by a rendering on a page item that the Content Author doesn't jave permission to edit, then this would mean that the Content Author could edit content for a page that (s)he does not have permission to edit.