Vulnerability in EPiServer.Forms

Try our conversational search powered by Generative AI!

David Sandeberg
May 18, 2010
(2 votes)

Hiding pages in EditTree

A problem for some of our customers with globalized websites is that the EditTree gets cluttered with pages only existing in one or a few languages.

The pages get displayed in italics and this, I take it, is a feature making it easy to get an overview of pages not having a language version in the selected language and also making it easy to create that version. This is fine when working with languages as intended by EPiServer, that is where all pages exists in all languages in a 1:1 relationship. This is however not the reality for several of our customers since they need to have different content in different market areas leading to a different page structure with different page types.

One of the new features of CMS 6 is the ability to assign access rights on languages. While this is a great improvement like many other things in the new release I was hoping for an option to hide pages that does not exist in a language accessible by the editor. This would solve the problem for editors only editing one language. When i couldn’t find this opiton I asked the EPiServer support team if this could be achieved in any way. They pointed me to a useful forum post that helped to get me started.

The goal of this post is a walk through of making a httpModule that hides pages in the EditTree based on

- Access rights on language

- Access rights in page structure

- The selected language in the drop down under the EditTree


First, we need to define a class that inherits from IHttpModule and hook into the DataFactorys FinishedLoadingChildren event.

public class PageExcluder: IHttpModule {

public void Dispose() {}

public void Init(HttpApplication context) {
EPiServer.DataFactory.Instance.FinishedLoadingChildren += new EPiServer.ChildrenEventHandler(Instance_FinishedLoadingChildren);

void Instance_FinishedLoadingChildren(object sender, EPiServer.ChildrenEventArgs e) {



This method gets called each time children is loaded so we need to make sure we only hide pages when actually loading the EditTree

if (HttpContext.Current.Request.Url.AbsolutePath.EndsWith("EditTree.aspx")) {


Now we need to iterate over the pages that has been loaded from the data factory

for (int i = 0; i < e.Children.Count; i++) {


While doing this we want to remove any pages that:

- Is not editable by the user based on access rights set on the language

// get the languages the user has access to edit
StringCollection languageAccess = new StringCollection();
foreach (LanguageBranch language in LanguageBranch.ListAll()) {
if (language.ACL.QueryDistinctAccess(EPiServer.Security.AccessLevel.Edit)) {
// remove pages that the user has no access to edit
if (!languageAccess.Contains(e.Children[i].LanguageID)) {


- Is not editable by the user based on access rights set in the page structure

if (!e.Children[i].QueryDistinctAccess(EPiServer.Security.AccessLevel.Edit)) {


- Does not have a language version in the language selected by the user in the drop down under the edit tree.

string selectedEditLang;
if (HttpContext.Current.Request.Cookies["editlanguagebranch"] != null)
selectedEditLang = HttpContext.Current.Request.Cookies["editlanguagebranch"].Value;
selectedEditLang = CultureInfo.CurrentUICulture.TwoLetterISOLanguageName;

if (e.Children[i].LanguageID != selectedEditLang) {


In the complete version of this module you can specify which one(s) of these checks you want to do by adding entries to your appSettings. You can download the complete project here.


This is my first blog post here on EPiServer world and i hope you found it useful. I appreciate any feedback, improvements or suggestions.

May 18, 2010


Sep 21, 2010 10:33 AM

Thank you for the nice information David. This can sure be useful!

Good blog start, keep it up =)

Adam Jenkin
Adam Jenkin May 3, 2012 03:02 PM

Hi David,

Many thanks, have just implemented this into a site I am working on (CMS6 R2) - I made a few changes - mainly by using an Initialisation Module and enabling the settings to be controlled through plugin settings (by site admin's) rather than appSettings.

Happy to send the code over to you if you want to update the download.


Lise Engmo Eggum
Lise Engmo Eggum May 7, 2012 03:58 PM

This is great! Adam; would love to see it with your extensions also.

Lise Engmo Eggum
Lise Engmo Eggum May 15, 2012 01:39 PM

Hi David! I have an issue when activating the "hide/show pages pased on the selected language in the drop down under the EditTree"; the waste basket is hidden for everyone. Any idea how to make that one visible?

Neil F
Neil F May 25, 2012 02:18 PM

LiseEE - I had the same problem, also noticed that the tree did not expand at all until selecting on/off a language, I suspect unless US at the top - allowing root page regardless of language check fixed both bugs. I'm only using the selected language check, so similar may be necessary on the other options:

if (e.Children[i].LanguageID != selectedEditLang && e.PageLink.ID != PageReference.RootPage.ID)

Please login to comment.
Latest blogs
Join the Work Smarter Webinar: Working with the Power of Configured Commerce (B2B) Customer Segmentation December 7th

Join this webinar and learn about customer segmentation – how to best utilize it, how to use personalization to differentiate segmentation and how...

Karen McDougall | Dec 1, 2023

Getting Started with Optimizely SaaS Core and Next.js Integration: Creating Content Pages

The blog post discusses the creation of additional page types with Next.js and Optimizely SaaS Core. It provides a step-by-step guide on how to...

Francisco Quintanilla | Dec 1, 2023 | Syndicated blog

Stop Managing Humans in Your CMS

Too many times, a content management system becomes a people management system. Meaning, an organization uses the CMS to manage all the information...

Deane Barker | Nov 30, 2023

A day in the life of an Optimizely Developer - Optimizely CMS 12: The advantages and considerations when exploring an upgrade

GRAHAM CARR - LEAD .NET DEVELOPER, 28 Nov 2023 In 2022, Optimizely released CMS 12 as part of its ongoing evolution of the platform to help provide...

Graham Carr | Nov 28, 2023

A day in the life of an Optimizely Developer - OptiUKNorth Meetup January 2024

It's time for another UK North Optimizely meet up! After the success of the last one, Ibrar Hussain (26) and Paul Gruffydd (Kin + Carta) will be...

Graham Carr | Nov 28, 2023

Publish content to Optimizely CMS using a custom GPT from OpenAI 🤖

Do you find the traditional editor interface complicated and cluttered? Would you like an editorial AI assistant you can chat with? You can!

Tomas Hensrud Gulla | Nov 28, 2023 | Syndicated blog