List and ReadOnly Object Security

SlyBelle posted on Sunday, October 22, 2006

When using readonly and list objects, shouldn't security be built into them as well to determine if a user can read the properties?  Unless I'm missing something, when I look at the readonly objects, I don't see any security checking going on like looking at a CanRead method like the editable business objects do.  Was this just left out or is the security somehow else implemented for this purpose and I'm just missing it?

Thanks for your help.

 

ajj3085 replied on Monday, October 23, 2006

I'm pretty sure there are still is a CanReadProperty method on RO objects, so you should be able to add security.

SlyBelle replied on Monday, October 23, 2006

I thought I looked at the base class for the readonly objects and did not see any reference to autorization rules for properties.

Also along the same lines, what if I want to do something special on the UI to hide/disable certain grid columns based on whether a user can read properties.  Is there a way to do this static versus having to load the object?  CanInsert, CanUpate, etc. works like this, just not sure if you can do the same from a property standpoint.

 

ajj3085 replied on Tuesday, October 24, 2006

Check again, its all there. 

To hide grid columns a user cannot see, the best way is probably CanReadProperty... but you're right it needs an instance.  

You should be able to add a static method which is similar in function, but there's one cavet; that obviously won't pick up instance authorization rules if you have any, for obvious reasons.

HTH
Andy

SlyBelle replied on Tuesday, October 24, 2006

Andy,

You were correct, I just missed it.  I was looking in the wrong place.  What through me off a little bit was in the Project example provided, it really didn't show it in use for the read only objects.  But I have now found that it does exist and would be available.

As for making it static, that is what I was thinking, but not really sure how to do it since ultimately I would have to have instances of the authorization rules and such.  So I'm not sure how I would really do that.  Just might be something I can't really achieve without actually making an instance and checking.  Probably not a huge deal in my app, but would have been nice to try and get working like the other CanXXX() security methods without instances.

Thanks a lot for all your help.  It has put me in the right direction.

 

 

 

ajj3085 replied on Tuesday, October 24, 2006

Glad I could help.

The PTracker example assumes anyone can look at any information, so that's why it doesn't show it.

You can make the CanReadProperty static method if you can get ahold of the AuthorizationRulesManager... but I think that might be an internal class..  so you may have to use reflection to get at it, and of course you're at the mercy of breaking changes then.