Seperate view and download permissions for custom types

[aniruddh]

Hi,
   I have a custom content model which has a base type from which other content types inherit. I have the following two requirements and I would ideally like to use custom permissions.

1. Seperate permissions for accessing node content (view) and downloading the node content
2. For the content type prevent the owner from deleting the content

I have tried to look for the solution in this forum and elsewhere but with no success. Has someone done this before? Please help.

[afaust]

Hello,

#1 is quite tricky, since you need the same permission for view as for download. The simplest option I see here is in specifying a custom permission set for your type, with a custom permission for download and only use this permission for Share DocLib UI action evaluation. I see no way to effectively guard against download via direct URI (if known or reconstructed by user), unless you are willing to replace the standard download services with custom implementations that check the permission on the repo layer.

#2 can be achieved without custom permissions. Simply define a rule or policy that transfers ownership to the OwnableService.NO_OWNER value when the node is created. This is the best opion since fiddling with the ownership permission on a definition level will likely produce some unwanted side effects due to its global usage.

Regards
Axel

[aniruddh]

Thanks Axel for your reply. I had a similar thoughts regarding #1 and was thinking of implementing the permission checks in a filter on the download servlet. The filter can check for the custom permission and send a response accordingly. Do you think this is a good idea?

[aniruddh]

I have tried creating a rule on a space to add the ownable aspect. But it does not work. I have a space named "Test Space" inside the users Home Space and added a rule to the space to add ownable aspect to any content. However, the delete button is still visible and the content can be deleted by the user. I have also tried creating a node policy OnCreateNodePolicy for my custom type and add the ownable aspect but with the same results. Please help.

[afaust]

Hello,

inside the users home space, it does not matter if the user is the owner of the content or not - the user the space belongs to always has administrator (i.e. coordinator) privileges on it and every content contained therein. So this is not a proper test of your rule - you should try it in a different location. The only way to achieve this is the users home space is by setting the inheritsParentPermissions flag to false in addition to revoking the ownership on the content - keep in mind though, for the user to have any access afterwards, you need to grant him explicit permissions on that node.

Regards
Axel