4

I have removed Read access to some items for certain a Role. The problem is that I can still see the items that I removed access to in the tree, when logging in as a (non-admin) user with the role that I denied Read access on.

enter image description here

When I click on the item that I removed Read access to, I get a "selecting item could not be found" error message.

enter image description here

Some of the users on this site are only allowed access to a specific sub-tree/set of pages, which makes the display of these items without read access and the popup message pretty jarring.

Is there any way for me to exclude items that the current user does not have Read access to from display in the Content Tree?


UPDATE:

Note that I did not explicitly deny Read access to the items, but rather removed the existing read access from inheritance, so that the access is denied, by default.


Version Used: Sitecore 8.1.2


Before you mark this as a duplicate, please note... I have read this similar post but the only answer does not support multiple roles, where one (with read access) should see the items in the tree and another (without read access) should not. Based on the comments on the one answer provided, I believe that the question was originally asked differently and then clarified to be similar to mine, which may have resulted in less attention and fewer answers being posted.

  • 1
    I just tested this to confirm. Removing read access should remove it from the tree in a clean instance. Do you have just one CM server? Did you try clearing the caches? – Ben Golden Dec 14 '16 at 19:14
  • @BenGolden Tried clearing the caches to no avail. Items are still showing for the test user. – Zachary Kniebel Dec 14 '16 at 19:17
  • I used 8.1 update 3 since I already had an instance of that running. I'm pretty sure this functionality didn't change between updates 2 and 3, but I can spin up an instance update 2 in a few minutes. – Ben Golden Dec 14 '16 at 19:34
  • Yep, I see the same behavior in 8.1 update 2. – Ben Golden Dec 14 '16 at 19:46
  • I see the expected behavior that the item does not show in the content tree when read access has been removed. – Ben Golden Dec 14 '16 at 19:50
3

As it turns out, there is actually a Sitecore setting that controls whether or not Sitecore should check security on each node when rendering the tree. If set to false, all nodes are shown and the error message that I described in my post is displayed if/when a user tries to open an item they do not have read access to.

<!--
  CONTENT EDITOR CHECK SECURITY ON TREE NODES
            Determines if the content editor checks the security settings on subitems
            when rendering the tree. Setting this to false may increase performance.
            Default value: true.

-->
<setting name="ContentEditor.CheckSecurityOnTreeNodes" value="true"/>

While the default value of this setting is true, in my case it turns out that one of the devs disabled this setting for sake of performance on their local environment and accidentally committed the change.

  • I had exactly this issue. This is quite an annoying side-effect of this change. We could do with a setting of how many levels deep to go or instead only for children of collapsed nodes and not the parent item it'self. – Adam Seabridge Mar 16 '17 at 14:33
  • @AdamSeabridge I totally agree. I ran a quick reference search, and (as expected) it doesn't look like there is a way to tap into the code that uses this setting to custom implement that. I think that would be a great, low-effort feature suggestion for an upcoming Sitecore release. – Zachary Kniebel Mar 16 '17 at 14:41
  • +1 for that :-). It seems a shame to have one setting that applies all the way down the tree instead of controlling at what level it applies. – Adam Seabridge Mar 16 '17 at 14:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.