Check permissions before displaying widgets

src/OrchardCore.Modules/OrchardCore.Flows/Views/FlowPart.cshtml

@@ -1,14 +1,22 @@
+@using Microsoft.AspNetCore.Authorization
 @using OrchardCore.ContentManagement
+@using OrchardCore.Contents
 @using OrchardCore.Flows.Models
 @using OrchardCore.Flows.ViewModels
 @using OrchardCore.Mvc.Utilities
 
 @model FlowPartViewModel
 @inject OrchardCore.ContentManagement.Display.IContentItemDisplayManager ContentItemDisplayManager
+@inject IAuthorizationService AuthorizationService
 
 <section class="flow">
     @foreach (var widget in Model.FlowPart.Widgets)
     {
+        if (!await AuthorizationService.AuthorizeAsync(User, CommonPermissions.ViewContent, widget))
+        {
+            continue;
+        }
+
         var widgetContent = await ContentItemDisplayManager.BuildDisplayAsync(widget, Model.BuildPartDisplayContext.Updater, Model.BuildPartDisplayContext.DisplayType, Model.BuildPartDisplayContext.GroupId);
         var flowMetadata = widget.As<FlowMetadata>();
 

src/OrchardCore.Modules/OrchardCore.Layers/Services/LayerFilter.cs

@@ -1,8 +1,10 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Caching.Memory;
 using OrchardCore.Admin;
 using OrchardCore.ContentManagement.Display;
 using OrchardCore.ContentManagement.Metadata;
+using OrchardCore.Contents;
 using OrchardCore.Data.Documents;
 using OrchardCore.DisplayManagement.Layout;
 using OrchardCore.DisplayManagement.ModelBinding;
@@ -27,6 +29,7 @@ public sealed class LayerFilter : IAsyncResultFilter
     private readonly IMemoryCache _memoryCache;
     private readonly IThemeManager _themeManager;
     private readonly IAdminThemeService _adminThemeService;
+    private readonly IAuthorizationService _authorizationService;
     private readonly ILayerService _layerService;
     private readonly IVolatileDocumentManager<LayerState> _layerStateManager;
 
@@ -40,6 +43,7 @@ public LayerFilter(
         IMemoryCache memoryCache,
         IThemeManager themeManager,
         IAdminThemeService adminThemeService,
+        IAuthorizationService authorizationService,
         IVolatileDocumentManager<LayerState> layerStateManager)
     {
         _contentDefinitionManager = contentDefinitionManager;
@@ -51,6 +55,7 @@ public LayerFilter(
         _memoryCache = memoryCache;
         _themeManager = themeManager;
         _adminThemeService = adminThemeService;
+        _authorizationService = authorizationService;
         _layerStateManager = layerStateManager;
     }
 
@@ -114,7 +119,7 @@ public async Task OnResultExecutionAsync(ResultExecutingContext context, ResultE
                     continue;
                 }
 
-                if (contentDefinitions.Any(c => c.Name == widget.ContentItem.ContentType))
+                if (contentDefinitions.Any(c => c.Name == widget.ContentItem.ContentType) && await _authorizationService.AuthorizeAsync(context.HttpContext.User, CommonPermissions.ViewContent, widget.ContentItem))
                 {
                     var widgetContent = await _contentItemDisplayManager.BuildDisplayAsync(widget.ContentItem, updater);
 

src/OrchardCore.Modules/OrchardCore.Widgets/Drivers/WidgetsListPartDisplayDriver.cs

@@ -1,9 +1,12 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
 using OrchardCore.ContentManagement;
 using OrchardCore.ContentManagement.Display;
 using OrchardCore.ContentManagement.Display.ContentDisplay;
 using OrchardCore.ContentManagement.Display.Models;
 using OrchardCore.ContentManagement.Metadata;
+using OrchardCore.Contents;
 using OrchardCore.DisplayManagement.Views;
 using OrchardCore.Mvc.Utilities;
 using OrchardCore.Widgets.Models;
@@ -15,16 +18,22 @@ namespace OrchardCore.Widgets.Drivers;
 public sealed class WidgetsListPartDisplayDriver : ContentPartDisplayDriver<WidgetsListPart>
 {
     private readonly IContentDefinitionManager _contentDefinitionManager;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IAuthorizationService _authorizationService;
     private readonly IContentManager _contentManager;
     private readonly IServiceProvider _serviceProvider;
 
     public WidgetsListPartDisplayDriver(
         IContentManager contentManager,
         IContentDefinitionManager contentDefinitionManager,
+        IHttpContextAccessor httpContextAccessor,
+        IAuthorizationService authorizationService,
         IServiceProvider serviceProvider
         )
     {
         _contentDefinitionManager = contentDefinitionManager;
+        _httpContextAccessor = httpContextAccessor;
+        _authorizationService = authorizationService;
         _contentManager = contentManager;
         _serviceProvider = serviceProvider;
     }
@@ -41,10 +50,17 @@ public override async Task<IDisplayResult> DisplayAsync(WidgetsListPart part, Bu
 
         var contentItemDisplayManager = _serviceProvider.GetRequiredService<IContentItemDisplayManager>();
 
+        var user = _httpContextAccessor.HttpContext.User;
+
         foreach (var zone in part.Widgets.Keys)
         {
             foreach (var widget in part.Widgets[zone])
             {
+                if (!await _authorizationService.AuthorizeAsync(user, CommonPermissions.ViewContent, widget))
+                {
+                    continue;
+                }
+
                 var layerMetadata = widget.As<WidgetMetadata>();
 
                 if (layerMetadata != null)