Locking down the site

Reply

Arthur Dent Posted: Fri, Apr 18 2008 5:48 PM

rated by 0 users

I'm running a website for my extended family: 8 blogs, 8 galleries, minimal forum usage, etc.  Because we share family pictures and personal information and many of us have young kids, we decided a while ago to restrict access to the site to only authenticated users, and I'd control who could request an ID, etc.  This was all under CS 2007.

The way I accomplished this was through the web.config file.  I entered the necessary rules to deny unauthenticated users, then allow certain paths for the themes to work, etc.  Then when my sister-in-law wanted her blog only opened back up to the public I added another web.config entry to allow that...

But the whole time I felt like I was going about this the wrong way.  I wasn't really touching the built in permissions structure in the control panel.

Now that I've upgraded to CS 2008 I'm either going to need to re-enter all those rules in my web.config file, or do it through the control panel.  But before shooting in the dark again, I wanted to see if anyone's done a similar set-up and get some pointers.

Thanks in advance!

Reply

Ken Robertson replied on Fri, Apr 18 2008 7:03 PM

rated by 0 users

Your best option would be to leverage the permissions within Community Server.  You can modify the default permissions for the various applications and remove permissions from the Everyone role (which is mainly used for Anonymous users) and ensure the Registered Users role has all the necessary permissions.  Each application implements its own permissions, and the default ones are applied to all forums/blogs/etc.

Then, you can override the default permissions for individual sections.  So you could go in and edit your sister-in-law's blog permissions and grant basic permissions back to the Everyone role.  This way, her blog would be public and all the others would still follow the default permissions.

Reply

duffGeiger replied on Mon, Apr 21 2008 10:17 PM

rated by 0 users

If the permissions prevent someone from seeing posts, media, etc. shouldn't they also prevent them from seeing the tags related to those private photos?

I'm trying to find a way to prevent public users from seeing the tags from private photos.

Thanks!

Reply

Shawn Hyde replied on Sat, May 24 2008 3:35 AM

rated by 0 users

I have to agree here, this worked just fine 2007 by unchecking read for everyone/anon users like this:

Everyone Role: All unchecked ( view | Reply | Manage Content )

Now in CS2008 doing :

Everyone Role: All unchecked ( View | Download | Delete | Edit | Reply | Upload | Local Files | Remote Files )

Still allows any joe-browser to view posted by. title and tag at the /media/ url.

How can we make it like 2007?

Where they would need to login to see anything for media galleries with Everyone role as above? 

I guess the only option is to turn off rss at the /ControlPanel/MediaGalleries/SyndicationOptions.aspx url for now but that does not resolve the problem with photo's already sent to RSS.

What can be done to remove this from the /media/ page?

Well you can go to /ControlPanel/Settings/Setup.aspx and click on "Aggregate Behavior" and "Use Only Public Media Gallery Sections for Aggregate Areas".

Reply

Alex Crome replied on Sat, May 24 2008 5:10 AM

rated by 0 users

 Can you check both the global media gallery permissions, the permissions of your gallery groups and the permissions of individual galleries (or blogs / forums as appropiate), and ensure they have no permissions set in those locations.

Reply

duffGeiger replied on Sun, May 25 2008 4:04 PM

rated by 0 users

Shawn Hyde:

What can be done to remove this from the /media/ page?

Well you can go to /ControlPanel/Settings/Setup.aspx and click on "Aggregate Behavior" and "Use Only Public Media Gallery Sections for Aggregate Areas".

Ug, I can't believe I didn't find that earlier. That fixed it, thanks!