Restrict access to language version

Tobias Nilsson

Vote:

We are launching a new globalized CMS 6 R2 public site for a client soon. The site will initally only be launched in two languages (sv,no) of three available (+da). The third language should not be accessible to unauthorized visitors. The site is not an enterprise site, meaning we only have one page tree which is globalized. The site will initialliy respond to www.xyz.se and www.xyz.no. The problem is that the third language is accessible by typing www.xyz.se/da.

I have played around with the default Visitor Groups but with no luck (with Everyone removed from the ACL). Perhaps I could build my own Visitor Group which checks the epslanguage parameter but that seem like a workaround.

What is the general best practice in this case?

#53448

Sep 08, 2011 18:41

Magnus Rahl

Vote:

As far as I know there's no way to restrict access to a language without completely disabling it. But it's the second time in just a couple of days that this question has come up, so maybe it's time to post a feature request for Vnext?

Do you have a base class for your templates? I suppose you could just override RequiredAccess() to do something like this:

public override AccessLevel RequiredAccess()
{
if (CurrentPage != null && CurrentPage.LanguageBranch == "da") return AccessLevel.Change

return Base.RequiredAccess();
}

Edit: Method modifier should of course be override, not virtual...

#53451

Edited, Sep 09, 2011 7:13

Frederik Vig

Vote:

You can set access level for each language in admin mode under Config and Manage Website Languages, click on the language you want to edit and remove the everyone group.

Hope this helps.

Frederik

#53467

Sep 09, 2011 10:53

Magnus Rahl

Vote:

But that only restricts which language an editor in a specific group can create, not what languages anonymous visitors can view once the pages are published. Or did I get that wrong?

#53469

Sep 09, 2011 10:58

Tobias Nilsson

Vote:

Frederik: it does not seem to affect the read access rights for unauthorized visitors as Magnus points out. I´ve tried removing the Everyone group from one language but it is still accessible since Everyone has Read rights through Admin-->Config-->'Set access rights'. I also tried to remove Everyone from 'Set access rights' but that only results in not being able to access any language branch as unauthorized user.

I´m leaning towards implementing a Visitor Group/Criterion which allows certain epslanguages (and /PageFiles/) and remove Everyone from 'Set Access rights'. Any comments on that solution?

#53473

Edited, Sep 09, 2011 11:26

Magnus Rahl

Vote:

You would have to use the visitor group as a role, so you could just aswell create a virtual role then, for example replace the standard "Everyone" virtual role with one checking the url for the da language branch for example.

But I think my solution overriding RequiredAccess is simpler.

#53474

Sep 09, 2011 11:39

Frederik Vig

Vote:

Hmm okay, then I would access the value through EPiServer's API create an HttpModule, Initializable module or whatever, check the language as early as possible and based on the access rules you've set in admin mode restrict access to that language version (basically implement what EPiServer should have implemented).

Frederik

#53475

Sep 09, 2011 11:40

Tobias Nilsson

Vote:

I'm just going to throw my 2 quick and dirty potential fixes out there.

Either you could do a redirect to the homepage with a query string so that you can present the user with a warning that the danish page isn't finished yet

Or you could copy the entire site tree and disable Danish on the original page tree and then when all content is done do some quick copy job.

#53486

Sep 09, 2011 17:23