Hi Frank,

There are several approaches depending on the feature. For more complex scenarios like the WebStore project there are various permissions about what roles can do what things so the WebStore has a more complex scenario and maintains its own role lists.

For more general features you typically pass the moduleid and pageid in the query string to your feature pages. Since query string params can be manipulated you need to check that the page represented by the pageid param actually contains the module represented by the moduleid. Then you just check if the user has permission to edit the page or has specific permission to edit the module.

The CurrentPage property of the mojoBasePage will always be determined by the pageid param

I actually just added a helper method for this today to the mojoBasePage. Its not in svn yet but it will be by tonight. Alternatively you can copy it into your local copy of Web\Components\mojoBasePage.cs :

public bool UserCanEditModule(int moduleID)
{
if(!Request.IsAuthenticated)return false;

if (CurrentPage == null) return false;

bool moduleFoundOnPage = false;
foreach (Module m in CurrentPage.Modules)
{
if (m.ModuleID == moduleID) moduleFoundOnPage = true;
}

if (!moduleFoundOnPage) return false;

if (WebUser.IsInRoles(CurrentPage.EditRoles)) return true;

SiteUser currentUser = SiteUtils.GetCurrentSiteUser();
if (currentUser == null) return false;

foreach (Module m in CurrentPage.Modules)
{
if (m.ModuleID == moduleID)
{
if (m.EditUserID == currentUser.UserID) return true;
}
}

return false;

}

Hope it helps,

Joe