Ово је још једна порука у мом у току Сериес о томе како да користите јКуери са СхареПоинт.
Ако желите да сазнате више о јКуери, Топло препоручујем: јКуери у акцији по Беар Бибеаулт и Јехуда Катз.

Једна од првих ствари које сам мислио, када сам почео да се играте са јКуери, was whether we could use it to secure a SharePoint view. The answer is “no” (или барем, I’m not claiming it’s possible). Међутим, it is certainly possible to make it difficult for people to see a particular view.

I started with my sandbox environment when working on this. I wrote about that environment here: Брзо и лако: Креирај своју Сандбок јКуери за СхареПоинт.

To “secure” a view, follow these steps:

1. Create a view you want to secure. I did that and called it “Secured View”.

   This is what it looks like when it’s not “secured”:

   

2. Add a content editor web part to the view’s page using the trick described in the sandbox article (и.е. add “PageView=Shared&ToolPaneView=2” to the URL).
3. Figure out your SharePoint _spUserId by following these crazy steps, believe or not:
   1. Log into your SharePoint environment.
   2. In the web browser’s address field, тип: “javascript:alert(_spUserId”).
   3. Record the result (it’s “13” in my case).

      

4. Add the following javascript to your CEWP in code view:
   
   

   <скрипта     "text/javascript" срц ="../../jQuery%20Library/jquery-1.3.2.min.js"> </скрипта> <сцрипт типе ="text/javascript"> $(функција() { alert(_spUserId); var theSecuredView = $('iframe[FilterLink*=Secured%20View]'); ако ((theSecuredView.length > 0) && (_spUserId == 13)) $('iframe[FilterLink*=Secured%20View]').родитељ().родитељ().родитељ().ХТМЛ("<тр бгцолор = црвена><тд>No view for you!</тд></тр>"); }); </скрипта>

I’ve included that alert(_spUserId) line in there to demonstrate how this is not really a “securing” a view, but simply making it more difficult to see. More on that in a moment.

У основи, jQuery is looking for an iFrame on the page who has an attribute that contains “Secured%20View” in its value. Once it finds it, we check to see if the current user is “13”. If it is, we walk up the DOM to a <ТР> tag (which I figured out by viewing source and tracing it) and then replacing that TR tag with my message. I really don’t know how robust this is (I’m very suspicious, заправо), but it worked in my sandbox. If I find a better way, I’ll blog about it. This is the result:

I click the OK button and the data is replaced with a big red message:

As you can tell, the way I’ve implement this “security” solution is to allow the web part to render itself. After it finishes, I overwrite its content with my “No view for you!” message.

Despite the fact that it’s not really a “secured’” view, it’s potentially useful and with some clever work, it may eventually be securable in a more formal sense. The fundamental issue is that the client is getting all the data and then, only after it gets the data, it wipes it out. If the client is getting the data, a clever user can prevent the jQuery from running at all and see what he/she wants to see.

There are other drawbacks. This “security” approach is based off a _spUserId. We’d want to really secure based on the full SharePoint security model, or at least by user name. That becomes progressively harder, but I see some good stuff written on this subject, so I’m hopeful there’s a good answer to that problem.

The list of views themselves should be trimmed, if possible. I haven’t tried to figure that out. I assume it’s possible, but doesn’t really solve the fundamental security issue because someone could still just type the URL of the view they want (if they knew it). Међутим, trimming makes sense. It’s a good usability feature and it helps to obfuscate things. If an end user doesn’t know that the view event exists, they probably won’t try to use it. Понекад, that’s good enough.

With luck, I’ll have more to write on this subject over time.

</крај>

Претплатите се на мој блог.

Следите ме на Туиттер на http://www.twitter.com/pagalvin