Using the Security Disabler With Glass Mapper

Question

I have a list of Photo items that I'm trying to get from my Glass Mapper model using the following declaration:

SitecoreField("Photos")]
public virtual IEnumerable<Photo> Photos { get; set; }

This set of photos is always empty when I'm not logged into Sitecore because the photos have Sitecore security on them. When I am logged into Sitecore (for example, in edit or preview mode while signed into the admin account), I can grab the photos just fine. Normally, to disable such security I would use the security disabler:

using (new Sitecore.SecurityModel.SecurityDisabler()){...}

I'm unsure of how to combine the security disabler with Glass Mapper to grab sitecore items that have security enabled. Any ideas on how I can disable this security from my Glass Mapper model? Thanks for the help!

Answer 1

The underlying service for GlassMapper is Sitecore. Just wrap it with a SecurityDisabler like normal.

You can find an example in the tutorials for GM. http://glass.lu/Mapper/Sc/Tutorials/Tutorial11

    void CommentSubmit_Click(object sender, EventArgs e)
    {
        var contextService = new SitecoreContext();
        var masterService = new SitecoreService("master");

        var page = contextService.GetCurrentItem<CommentPage>();
        //we could also use the model property instead of the line above:
        // var page = this.Model;

        var comment = new Comment();

        //This value will be used for the name of the item
        comment.Name = DateTime.Now.ToString("yy-MM-ddThh-mm-ss");
        comment.Content = CommentContent.Text;
        comment.FullName = CommentName.Text;
        comment.Email = CommentEmail.Text;

        using (new SecurityDisabler())
        {
            masterService.Create(page, comment);
        }

        CommentThankYou.Visible = true;
        comment.Content = string.Empty;
        comment.FullName = string.Empty;
        comment.Email = string.Empty;
    }

Answer 2

I would recommend using user switcher instead of security disabler.

Sitecore.Security.Accounts.User user = Sitecore.Security.Accounts.User.FromName(@"(sitecore user with permission)", true);
        using (new Sitecore.Security.Accounts.UserSwitcher(user))
        {}

Answer 3

After looking at it a little bit more this is what I went with. It's ugly but it gets the job done. I'm still very much open to a cleaner solution.

    [SitecoreField("Photos")]
    public virtual IEnumerable<Photo> Photos {
        get {
            List<Photo> photos = new List<Photo>();
            using (new Sitecore.SecurityModel.SecurityDisabler())
            {
                var contextService = new SitecoreContext();
                Item page = contextService.GetItem<Item>(this.Id);
                MultilistField list = page.Fields["Photos"];
                foreach (Item child in list.GetItems())
                {
                    Photo currPhoto = contextService.Cast<Photo>(child);
                    photos.Add(currPhoto);
                }
            }
            return photos;
        }
    }