15

I've seen some similar questions, but none that look like what I'm trying to do.

This is my current implementation w/out any security:

<div id="menucontainer">
    <ul id="menu">              
        <li><%= Html.ActionLink("Main List", "Index", "AController")%></li>
        <li><%= Html.ActionLink("Product List", "Index", "BController")%></li>
        <li><%= Html.ActionLink("Company List", "Index", "CController")%></li>
        <li><%= Html.ActionLink("User List", "Index", "DController")%></li>
    </ul>
</div>

This is fine, and the above works. I have [Authorize] Attributes setup on the Actions for CController and DController to prevent unauthorized access -- but I'd like to remove those items from the menu for users who don't have the correct Role, because when they see it and click on it and it tells them they don't have permission, they'll want it. If they don't know it's there, that's just better for everyone involved...

Something like this is ultimately the goal I'm trying to get at, but I'm looking for the more MVC Flavored aproach, where the "view" is "dumb":

<div id="menucontainer">
    <ul id="menu">              
        <li><%= Html.ActionLink("Main List", "Index", "AController")%></li>
        <li><%= Html.ActionLink("Product List", "Index", "BController")%></li>
        <% If(Role = Roles.Admin) { %>
        <li><%= Html.ActionLink("Company List", "Index", "CController")%></li>
        <li><%= Html.ActionLink("User List", "Index", "DController")%></li>
        <% } %>
    </ul>
</div>
Marijn
  • 10,367
  • 5
  • 59
  • 80
Nate
  • 30,286
  • 23
  • 113
  • 184
  • I am... I think. There are two levels of user, Normal and Admin. Only admin can see Company and User lists, the [Authorize] attributes on the controller prevent unauthorized access, but I want to hide the view from non-Admin's so they don't even get the idea that its there in their head. – Nate Feb 04 '10 at 21:29

6 Answers6

15

I have done something like this:

  • use a common base class for my controllers ('layer supertype')
  • in the BaseController, override OnActionExecuted (you could also define an ActionFilter attribute for this)

Something like this:

    protected override void OnActionExecuted(ActionExecutedContext filterContext)
    {
        // build list of menu items based on user's permissions, and add it to ViewData
        IEnumerable<MenuItem> menu = BuildMenu(); 
        ViewData["Menu"] = menu;
    }

In the master page:

    <% var model = ViewData["Menu"] as IEnumerable<MenuItem>; %>
    <% Html.RenderPartial("Menu", model); %>

(Note: in reality, I have a MasterViewModel that contains among others the menu model)

saluce
  • 13,035
  • 3
  • 50
  • 67
jeroenh
  • 26,362
  • 10
  • 73
  • 104
  • I presume ActionExecutedContext will have information about the current user? and I simply need to update all my controllers to inherit from this new base controller I've defined? – Nate Feb 04 '10 at 21:40
  • 1
    yes, the ActionExecutedContext gives you access to a.o. the HttpContext – jeroenh Feb 05 '10 at 07:50
  • 2
    heh, I feel like a total n00b, but that's a new one to me. Thanks. – Pretzel Jun 07 '10 at 13:27
  • 1
    @jeroenh: So I started another thread referencing your answer here. Basically, I'm trying to flesh out your answer to a full class, but am struggling with getting it done right. Don't know if you want to toss in your 2 cents. http://stackoverflow.com/questions/2999918/how-to-discover-classes-with-authorize-attributes-using-reflection-in-c-or-h/2999979#2999979 – Pretzel Jun 08 '10 at 19:49
2

Nobody's mentioned MvcSiteMapProvider which does this and can be easily integrated into your Visual Studio project using NuGet.

Joe
  • 122,218
  • 32
  • 205
  • 338
2

Did you hear about MvcContrib's MenuBuilder?

If not, I suggest you take a look at it. The example project UI is a good way to start learning how to use it.

Leniel Maccaferri
  • 100,159
  • 46
  • 371
  • 480
Fitzchak Yitzchaki
  • 9,095
  • 12
  • 56
  • 96
1

Usually I just check the role in a similar way you did and then either render a partial view with the links or just create them. Something like this using Razor syntax. I use T4MVC for actions.

@if(User.IsInRole("Admin"))
{
    <li><a href="@Url.Action(MVC.Admin.User.Index())">Users</a></li>
}

For security I use Fluent Security. Hope this helps.

lopezbertoni
  • 3,551
  • 3
  • 37
  • 53
0

Joe's solution by far was the simplest and worked for me. I have pages present in separate areas for which I need to quickly setup a menu system that reacts and works based on which area the user is present in. Also in my case there are no cross-area links in my system, so am going to next configure multiple sitemaps for the MvcSiteMapProvider.

Hope this helps anyone else looking for a simple and effective solution!

Azerax
  • 41
  • 1
  • 8
0

Like @SD" said, you can create a "shiny" helper that with either render the link, or not, based on your security requirement.

Here is a good read on custom helpers (towards the bottom):

understanding-html-helpers on S. Walther's blog

Billy Coover
  • 3,827
  • 5
  • 36
  • 50