gistfile1.txt

using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Threading;
using System.Threading.Tasks;
using System.Web;
using Umbraco.Core;
using Umbraco.Core.Models;
using Umbraco.Core.Models.Membership;
using Umbraco.Web;
using HSC.Media.Extensions;
using Umbraco.Web.Models.ContentEditing;
using HSC.Media.Models;
using Umbraco.Web.Models.Trees;

namespace HSC.Media.Delegate
{
    public class WebApiHandler : DelegatingHandler
    {
        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            var user = UmbracoContext.Current.Security.CurrentUser;


            switch (request.RequestUri.AbsolutePath.ToLower()) {
                case "/umbraco/backoffice/umbracoapi/media/getchildren":
                    return FilterMediaGetChildren(request, cancellationToken, user);
                case "/umbraco/backoffice/umbracoapi/media/getbyid":
                //    return FilterMediaMenu(request, cancellationToken, user);
                default:
                    return base.SendAsync(request, cancellationToken);
            }
        }

        private Task<HttpResponseMessage> FilterMediaGetChildren(HttpRequestMessage request, CancellationToken cancellationToken, IUser user)
        {
            return base.SendAsync(request, cancellationToken)
                .ContinueWith(task =>
                {
                    var response = task.Result;

                    var items = ((Umbraco.Core.Models.PagedResult<Umbraco.Web.Models.ContentEditing.ContentItemBasic<Umbraco.Web.Models.ContentEditing.ContentPropertyBasic, Umbraco.Core.Models.IMedia>>)(((System.Net.Http.ObjectContent)(response.Content)).Value)).Items;

                    if (items != null)
                    {
                        items = items.Where(item => UserCanView(user, item));
                        ((Umbraco.Core.Models.PagedResult<Umbraco.Web.Models.ContentEditing.ContentItemBasic<Umbraco.Web.Models.ContentEditing.ContentPropertyBasic, Umbraco.Core.Models.IMedia>>)(((System.Net.Http.ObjectContent)(response.Content)).Value)).Items = items;
                    }
                    return response;
                });
        }

        //private Task<HttpResponseMessage> FilterMediaMenu(HttpRequestMessage request, CancellationToken cancellationToken, IUser user)
        //{
        //    var ms = ApplicationContext.Current.Services.MediaService;
        //    var media = ms.GetById(int.Parse(request.RequestUri.ParseQueryString().Get("id")));
        //    var user2NodePermissions = ms.GetUser2NodePermissions(media.Path, user);
        //    if (user2NodePermissions == null)
        //        user2NodePermissions = user.GetDefaultPermission(media.Id);

        //    return base.SendAsync(request, cancellationToken)
        //        .ContinueWith(task =>
        //        {
        //            var response = task.Result;
        //            var menu = ((Umbraco.Web.Models.Trees.MenuItemCollection)(((System.Net.Http.ObjectContent)(response.Content)).Value));
        //            var items = new MenuItemList(menu.Items);

        //            if (!user2NodePermissions.AssignedPermissions.Contains("F"))
        //                items.Clear();

        //            if (!user2NodePermissions.AssignedPermissions.Contains("C"))
        //                items.Remove(items.Where(x => x.Alias == "create").FirstOrDefault());

        //            if (!user2NodePermissions.AssignedPermissions.Contains("D"))
        //                items.Remove(items.Where(x => x.Alias == "delete").FirstOrDefault());

        //            if (!user2NodePermissions.AssignedPermissions.Contains("M"))
        //                items.Remove(items.Where(x => x.Alias == "move").FirstOrDefault());

        //            if (!user2NodePermissions.AssignedPermissions.Contains("S"))
        //                items.Remove(items.Where(x => x.Alias == "sort").FirstOrDefault());

        //            if (!user2NodePermissions.AssignedPermissions.Contains("L"))
        //                items.Remove(items.Where(x => x.Alias == "refreshNode").FirstOrDefault());


        //            var finalMenu = new Umbraco.Web.Models.Trees.MenuItemCollection(items);
        //            finalMenu.DefaultMenuAlias = menu.DefaultMenuAlias;

        //            ((System.Net.Http.ObjectContent)(response.Content)).Value = finalMenu;

        //            return response;
        //        });
        //}

        private bool UserCanView(IUser user, Umbraco.Web.Models.ContentEditing.ContentItemBasic<Umbraco.Web.Models.ContentEditing.ContentPropertyBasic, Umbraco.Core.Models.IMedia> item)
        {
            var ms = ApplicationContext.Current.Services.MediaService;
            
            var hasPermission = false;
            // check for set permissions
            var user2NodePermissions = ms.GetUser2NodePermissions(item.Path, user);
            if (user2NodePermissions == null)
                user2NodePermissions = user.GetDefaultPermission(int.Parse(item.Id.ToString()));

            if(user2NodePermissions!= null)
            {
                if (user2NodePermissions.AssignedPermissions.Contains("F"))
                {
                    hasPermission = true;
                }
            }
            else
            {
                //default permissions.
                hasPermission = user.DefaultPermissions.Contains("F");
            }
            return hasPermission;
        }
    }
}