Accessing Portal Registry Objects

When you get a folder, content reference, content reference link, PageletCategory or Pagelet collection, only the items that the end-user is authorized to access are in the collection. Whether an object is contained in a collection is based on the following algorithm:

• If the object is marked as PublicAccess it is automatically accessible.

• If the object is marked as AuthorAccess and the current UserId is the Author it is accessible.

• If the current user is in a permission list (class) that is in the Permissions collection for that object.

• If the current user is in a permission list (class) that is in the CascadedPermissions collection for that object.

• If the current user has the Portal Administrator role.

When you access a content reference or folder using a valid name and one of the Find methods (FindCRefByURL, FindCRefByName, FindCRefForURL, or FindFolderByName) a content reference or folder is returned whether the user is authorized to it. When you use these methods, always check the Authorized property. This is the only property you can view from an object that an end-user isn't authorized to.

In addition, if you know the specific URL for a tab, you could specify that in the FindCRefByURL. The tab is returned whether the user is authorized to it, so you should always check the Authorized property.