Use GET to determine node accessibility

[MaxKot]

I have two actions with the same name: one for GET requests and another one for POST. These action have require different user roles (the user must have write access for POST).

AuthorizeAttributeAclModule uses current HTTP method to determine the action so users without write access don't have the site map node after they POST on some other page. This is not right because following links in a site map generates GET requests.

I think HTTP method should be configurable or GET.

[NightOwl888]

@MaxKot

Is it possible you could provide a small sample project showing how you use this functionality? We have v4 in beta now, but I just realized that this functionality is not yet implemented there. It would be a big help if we have a way to ensure we can get it to work the way it was intended to.

Alternatively, if you could submit another pull request based on the v4 branch that would be great.

[MaxKot]

@NightOwl888

I created a demo project for the issue. The text in the views and comments in HomeController should explain the issue.

I hope I will fix the issue in the v4 branch tomorrow evening or on the weekend.

[NightOwl888]

Hey, thanks for doing this. If you don't have the time to implement it will be a big help.

[NightOwl888]

@MaxKot

In your demo project, you provided XML as follows:

<?xml version="1.0" encoding="utf-8" ?>
<mvcSiteMap xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xmlns="http://mvcsitemap.codeplex.com/schemas/MvcSiteMap-File-4.0">

  <mvcSiteMapNode title="Demo site" controller="Home" action="Index" visibility="!*" httpMethod="GET">
    <mvcSiteMapNode title="Home" controller="Home" action="Index"/>
    <mvcSiteMapNode title="About" controller="Home" action="About"/>
  </mvcSiteMapNode>

</mvcSiteMap>

However, it does not function correctly this way because httpMethod is not inherited. It only functions correctly if the httpMethod is added specifically on the nodes that require it.

<?xml version="1.0" encoding="utf-8" ?>
<mvcSiteMap xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xmlns="http://mvcsitemap.codeplex.com/schemas/MvcSiteMap-File-4.0">

  <mvcSiteMapNode title="Demo site" controller="Home" action="Index" visibility="!*">
    <mvcSiteMapNode title="Home" controller="Home" action="Index"/>
    <mvcSiteMapNode title="About" controller="Home" action="About" httpMethod="GET"/>
  </mvcSiteMapNode>

</mvcSiteMap>

I am trying to determine if this is the expected behavior, as someone has opened another issue about this #230. I went back to v4.0.14 (before the changes to AuthorizeAttributeAclModule), but it functions exactly the same way.

It seems like it should use GET by default if httpMethod is not supplied (to make MvcSiteMapProvider do a POST, the HTML helpers would need to be modified to spit out form tags or JavaScript), but the logic you provided uses the current HTTP method by default.

So, it seems that the logical way to do this would be:

• By default, httpMethod is empty string - use GET
• httpMethod is * or "CURRENT", use HTTP method of current request
• httpMethod is specified as something else, use that value

That would cover all of the possible scenarios, but using httpMethod parameter would only be required if you modify the HTML helpers.

Thoughts?

[MaxKot]

@NightOwl888

Using GET by default would be great for me. I used current HTTP method by default only as a backwards-compatibility precaution.

As for httpMethod I did expect it to be inherited by the child nodes but it is not important if GET would be used by default.

[NightOwl888]

Well, backwards compatibility wasn't that much of a concern in a major release - unfortunately, now we have to make a potentially breaking change in a minor release. But the fact of the matter is the default behavior is broken given the default behavior of how the nodes are rendered, and the reality is the change probably won't affect that many users.