Doodle Graphics

I recently had a requirement to lock down some media items (PDFs in this case) within Sitecore so that only certain logged in users could access them. In principle this is trivially easy - ensure the users are in the right roles, remove read access from the extranet\anonymous user and grant read access to the specific roles. However, as always, the devil is in the details.

Whilst the above steps did work and users were correctly sent to the login page there was a problem - once the user logged in, they were just sent to the home page of site rather than being returned to the item they'd requested.

Checking the web.config I found the following setting, which defaults to false:

<setting name="Authentication.SaveRawUrl" value="true" />

But setting it to true here didn't actually make any difference - because the out of the box MediaRequestHandler ignores this value. I'm not really sure whether that makes sense at all - if I lock down some images for example, but then include them on a publicly accessible page the user isn't going to be prompted to log in, they'd just get broken images as the browser requests an image but gets HTML in response, but in the context of a PDF or other document surely you'd want to log in and be returned to the correct place.

Anyway, the solution was fairly straight forward. I created a new RestrictedMediaRequestHandler that inherits MediaRequestHandler and then overrode only the DoProcessRequest method:

/// <summary>

/// Extends the Sitecore MediaRequestHandler to include the requested

/// URL in the redirect to the login page.

/// </summary>

public class RestrictedMediaRequestHandler : MediaRequestHandler

{

  protected override bool DoProcessRequest(HttpContext context)

  {

    Assert.ArgumentNotNull(context, "context");

    MediaRequest request = MediaManager.ParseMediaRequest(context.Request);

    if (request == null) {

      return false;

    }



    Media media = MediaManager.GetMedia(request.MediaUri);

    if (media != null) {

      // We've found the media item, so send it to the user

      return DoProcessRequest(context, request, media);

    }



    using (new SecurityDisabler()) {

      // See if the media item exists but the user doesn't have access

      media = MediaManager.GetMedia(request.MediaUri);

    }



    string str;

    if (media == null) {

      // The media item doesn't exist, send the user to a 404

      str = Settings.ItemNotFoundUrl;

    } else {

      Assert.IsNotNull(Context.Site, "site");

      str = Context.Site.LoginPage != string.Empty ?

          Context.Site.LoginPage : Settings.NoAccessUrl;



      if (Settings.Authentication.SaveRawUrl) {

        var list = new List<string>(new[]

                                    {

                                        "item",

                                        Context.RawUrl

                                    });



        str = WebUtil.AddQueryString(str, list.ToArray());

      }

    }



    HttpContext.Current.Response.Redirect(str);

            

    return true;

  }

}

Then I updated the web.config to tell the sitecore media handler to use this new handler instead of the default one, and all was well in the world:

<add verb="*" path="sitecore_media.ashx"

     type="Custom.Infrastructure.Sitecore.RestrictedMediaRequestHandler, Custom.Infrastructure"

     name="Custom.RestrictedMediaRequestHandler" />

And now when a user requests a PDF they don't have access to they are sent to a login page that can return them to the PDF afterwards.

Filed under: ASP.NET, Sitecore