Show asp.net webpart elements based on user permission level?

Question

I want to do the following:

I have a webpart and two users (not in groups, though, because for a reason I don't understand there are no groups in the productive environment here ;) ).

One stands for the "attendee". This user(s) has read permissions to the sitecollection i'm creating atm.

The other one stands for the "editor". This user(s) has contribute permissions.

Now I have a visual webpart on top of the DispForm of a custom list which shows the attendee a button (for simplicity). Everything the attendee could do is done with runwithelevatedprivileges-method, so he has only read-rights, even though he could do some actions. Apart from that, I'm calling my method (let's call it GetAttendeeView) to get the button in page_load.

Now I want to show my editors another button with custom action behind. I want to do it based on the permission level in page_load. So if user has read-permissions, show this button, if user has contribute-permission, show that button.

So my questions are:

1) Is there a Sharepoint-method I can use? I just found this: http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.checkpermissions.aspx (checkpermissions) but its not giving me a bool-value to check, it throws an exception. Apart from that it's on List-Level. I think it is possible to use it, but it seems to me there shall be a better solution.

2) Is there a better way to check the user (it's the web.currentUser btw.) and show the buttons depending on permissions apart from checking it every time the page loads in page_load? I think this may cause a possible slow-down?!

Greetings, Dominik

Answer 1

You may want to have a look at the SPSecurityTrimmedControl.

It provides you with a sort of "container" (think about a panel) that can hide the controls inside it based on the required permission.

<SharePoint:SPSecurityTrimmedControl PermissionsString="AddAndCustomizePages, ManageLists" 
    runat="server"> 
    <%--content goes here %>
</SharePoint:SPSecurityTrimmedControl>

In the above sample, the contents would only be visible if you had the specified permissions.

I have used it in the past and it works fine. Only thing to keep in mind is that the control works by stopping rendering, so some control related event may still happen (for example, an onload handler attached to some usercontrol or such). Don't know if SP2010 has changed this, will try to give it a look.

Anyway, if you need some more complex logics you can extend it. I had to add group trimming support, so if you need leave a notice here and I will post some guidance.