Umbraco-cms: How to 'specify permissions' on an Umbraco dashboard?

[lcichanowicz]

I found the documentation for managing dashboards. It is not helpful for my task. I need to hide the Redirect URL Management dashboard from users in the Writers group. (It seems like a bug that it shows for them!) In other words, I need to 'specify permissions' on an Umbraco (built-in) dashboard. The docs do not cover this important task. They only show how to remove an Umbraco dashboard. I cannot remove the Redirect URL Management dashboard, because Administrators use it.

I tried putting a package.manifest in the App_Plugins folder; however, I do not know the alias of the Redirect URL Management dashboard.

I found the Redirect URL Management view, but I could not easily track down its alias.

{
    "dashboards":  [
        {
            "alias": "redirectUrls",
            "sections": [ "content"],
            "access": [
                { "deny": "writer" },
                { "grant": "admin" }
            ]
        }
    ]
}

In v7, its alias was RedirectUrlManagement. In early v8, it appears it was RedirectUrlDashboard. In the aforementioned documentation, it only references its language key, which is dashboardTabs/contentRedirectManager.

Sadly, once again, something that was dead simple in v7 is complicated and poorly documented. Any help would be greatly appreciated.

---

_This item has been added to our backlog AB#5462_

[soreng]

As discussed here: https://our.umbraco.com/forum/using-umbraco-and-getting-started/96364-hide-redirect-url-management-from-editors

There are different opinions on this, and you are already able to solve it.

The Dashboard is not added via a manifest, but via the Dashboard collection builder. AFAIK the only way to alter the permissions for the dashboard, is to implement it as suggested.

An example on implementing access rules can be found here https://github.com/umbraco/Umbraco-CMS/blob/ecb6f93e54de1f37e83f4c85bffe81d32c86d917/src/Umbraco.Web/Dashboards/ContentDashboard.cs

[lcichanowicz]

Thanks @soreng. How do I find the alias of the Redirect URL Management dashboard?

Also, I seem to be running into this bug:
https://our.umbraco.com/forum/extending-umbraco-and-using-the-api/97493-dashboards-not-obeying-accessrules

[soreng]

What do you need the alias for?
It’s “contentRedirectManager”, found in RedirectUrlDashboard.cs

I dont see a bug report on the issue from the our-thread. Should this issue be that?

Please beware that the rules are bot applied directly in the order they are added, but grouped by type first. Have a look at https://github.com/umbraco/Umbraco-CMS/blob/ba064ba4f52033996baec62286053ce7b8b7191a/src/Umbraco.Web/Services/DashboardService.cs to see how it is implemented.

[lcichanowicz]

How am I supposed to add that dashboard back with permissions? I am confused. In the "Our" thread, you seem to be telling me to make a custom replacement dashboard from scratch, which is ludicrous.

I created a custom dashboard, as a test, and Umbraco does not honor the single access rule on it. How can I expect it to honor one when I add the back the dashboard that I should not have to remove in the first place? This is a mess.

[soreng]

You want to change something, and one option is to remove the thing that don’t fit, and add one that does.

This is how umbraco 8 is build.

[lcichanowicz]

In 7, Umbraco was built to handle this situation.

[lcichanowicz]

8 should not remove basic functionality.

[lcichanowicz]

I don't "want to change something". A screw-up in Umbraco 8 forces me to.

[lcichanowicz]

What I want is for users who should not have access to other users' content to not have access to other users' content. I ask too much?

[soreng]

I really don’t see it that way. You are trying to do sometime that is not an everyday task, and want to change something in the system.

I don’t think adding your own dashboard to allow for this, it that big of a task.

[lcichanowicz]

You cannot explain away the fact that in 7 this was a simple config setting.

[lcichanowicz]

Now in 8, I am a crazy man for wanting to do something that was commonly done in 7, with a simple config settting? I'm going off the rails all of a sudden?

[lcichanowicz]

You are battling with me instead of helping me correct a deficiency in 8.

[lcichanowicz]

AND, Umbraco 8 DOES NOT HONOR MY "DENY" ON MY SIMPLE CUSTOM DASHBOARD TEST.

[lcichanowicz]

I still see my custom dashboard when logged in as a user who is only in the admins role.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using Umbraco.Core;
using Umbraco.Core.Composing;
using Umbraco.Core.Dashboards;
using Umbraco.Web;

namespace u8Dashboards
{
    [Weight(-10)]
    public class MyDashboard : IDashboard
    {
        public string Alias => "pucCustomDashboard";

        public string[] Sections => new[]
        {
            Umbraco.Core.Constants.Applications.Content,
            Umbraco.Core.Constants.Applications.Settings
        };

        public string View => "/App_Plugins/PUC/PucDashboard.html";

        //public IAccessRule[] AccessRules => Array.Empty<IAccessRule>();

        public IAccessRule[] AccessRules
        {
            get
            {
                var rules = new IAccessRule[]
                {
                     new AccessRule {Type = AccessRuleType.Deny, Value = Umbraco.Core.Constants.Security.AdminGroupAlias}
                };
                return rules;
            }
        }
    }
}

[soreng]

Sorry, I was not trying to battle you, but rather help you find a solution.

[lcichanowicz]

Me: I want to deny writers access to the Umbraco dashboard for URL rewrites--because it gives them global access to rewrites for pages outside of their restricted content node.

You: Throw away the whole dashboard and make and new one. Welcome to Umbraco 8.

[lcichanowicz]

In addition, I am doing all of this trickery to get to set permissions on an Umbraco dashboard, and Umbraco will not even honor my single permission on the simple custom dashboard, using the code above.

So, on a scale of 1 to 10, this "solution" is a 0.

[nul800sebastiaan]

@lcichanowicz I understand that you're very frustrated but please keep it friendly, no need for all caps posts. Also please note that @soreng is just trying to help you, something which he has no obligation to do on a Sunday night. 👍

Yes, totally agreed, we did not foresee this scenario at all in v8 and we should do something about it!

For now, the only solution is the workaround offered, which is not the ideal situation for sure, but better than nothing.
As for it not working, this is caused by the "SuperUser" (as in: the first user created in Umbraco, the user with id -1) being allowed to see all dashboards: https://github.com/umbraco/Umbraco-CMS/blob/v8/dev/src/Umbraco.Web/Services/DashboardService.cs#L70

I have tested logging in with a different admin user and the dashboard is hidden as expected.

[lcichanowicz]

@nul800sebastiaan, thanks for weighing in. My frustration (all caps) was with Umbraco--not with @soreng. Umbraco 8 seems like a downgrade from 7 in so many ways. Note that I was not working on the weekend for fun either. This cascade of Umbraco 8 issues was affecting a live site, with thousands of users (writers) seeing that URL Rewrite dashboard as their only dashboard--for global rewrites, exposing other user's data.

[nul800sebastiaan]

Great, that it was not directed at Søren but my comment stays the same, it's fine to be frustrated but let's put our energy in making a positive change instead of focusing on past mistakes.

I am also happy to listen to the cascade of issues that you've found, most of which we will probably not be able to magically solve for you right away, but it's great to get feedback on what people are struggling with as valuable input on what we can work with.

[lcichanowicz]

I like the whole "Friendly CMS" thing. I find it _un_friendly to be told a bug is not a bug. The most efficient, and least frustrating way forward to positive change, is to recognize and own the deficiency being reported. That definitely was not happening here.

[nul800sebastiaan]

I think you're confused. @soreng doesn't work for Umbraco HQ.

I do work there and the first thing I did after the weekend was to acknowledged the issue and told you I think we should work on it.

[Shazwazza]

This should work:

public class MyComposer : IComposer
{
    public void Compose(Composition composition)
    {
        composition.Dashboards()
            // Remove the default
            .Remove<RedirectUrlDashboard>()
            // Add the overridden one
            .Add<MyRedirectUrlDashboard>();
    }
}

// overridden redirect dashboard with custom rules
public class MyRedirectUrlDashboard : RedirectUrlDashboard, IDashboard
{
    // override explicit implementation
    IAccessRule[] IDashboard.AccessRules { get; } = new IAccessRule[]
    {
        new AccessRule {Type = AccessRuleType.Deny, Value = "writer"},
        new AccessRule {Type = AccessRuleType.Grant, Value = Umbraco.Core.Constants.Security.AdminGroupAlias}
    };
}

Can this be easier? Yes! Ideally the interface for IDashboard could have allowed a mutable collection for access rules but unfortunately thats not the case otherwise it would have been reasonably easy. The IAccessRule themselves is mutable but that doesn't solve this problem of adding/removing rules from the dashboard definition.

We could allow adding custom filters to override rules which could look something like:

public class MyComposer : IComposer
{
    public void Compose(Composition composition)
    {
        composition.Dashboards()
            .Modify<RedirectUrlDashboard>(new IAccessRule[]
            {
                new AccessRule {Type = AccessRuleType.Deny, Value = "writer"},
                new AccessRule {Type = AccessRuleType.Grant, Value = Umbraco.Core.Constants.Security.AdminGroupAlias}
            });
    }
}

The Modify method could also allow modifying the sections.

Some things in v8 had to be rebuilt, things that relied on the legacy configuration patterns and configuration 'provider' models. The config first approach is legacy because it is inflexible, error prone, doesn't allow for modern coding standards, etc... With these components rebuilt the way they are, it is certainly possible to re-add configuration back in where it makes sense. We didn't remove file based configuration just to be annoying, it was just re-added for the 8.0 release since we need to gauge the requirement for it and whether/where it makes sense.

[lcichanowicz]

Thanks, @Shazwazza! I express my gratitude with a PR.

https://github.com/umbraco/UmbracoDocs/pull/2335

[Shazwazza]

@lcichanowicz wonderful 🎉 Next we need an up-for-grabs task to do what I've mentioned above with the Modify method... that is if folks think its important enough

[nul800sebastiaan]

Sweet! Great addition to the docs too! 👍

I'll link to this related issue, looking into it now: https://github.com/umbraco/Umbraco-CMS/issues/7758

[umbrabot]

Hi @lcichanowicz,

We're writing to let you know that we've added the Up For Grabs label to your issue. We feel that this issue is ideal to flag for a community member to work on it. Once flagged here, folk looking for issues to work on will know to look at yours. Of course, please feel free work on this yourself ;-). If there are any changes to this status, we'll be sure to let you know.

For more information about issues and states, have a look at this blog post

Thanks muchly, from your friendly PR team bot :-)