Filter search results by view permissions

Sitefinity CMS can automatically filter content queries so that items the current user cannot view are excluded from results. You can enable this filtering globally or on a per-provider basis. For search index scenarios, you can also store view permissions directly in the search index to improve performance and pagination.

NOTE: Enabling this setting globally can affect performance. To improve performance, you can store permissions in the search index. For more information, see Store view permissions in the search index.

To enable filtering queries by view permissions globally, perform the following:

1. Navigate to Settings » Advanced » Security.
2. Locate the FilterQueriesByViewPermissions setting (Enable filtering queries by view permissions).
3. Enable the setting.

To enable filtering for a specific provider, perform the following:

1. Navigate to the advanced settings for the relevant module. For example, navigate to Advanced settings » Libraries » Providers.
2. Select the provider.
3. Select Parameters and click Add new.
4. Set the following parameter:
   
   • Key: filterQueriesByViewPermissions
   • Value: true

PREREQUISITES: This capability is available as of version Sitefinity CMS 15.4.8629 in Sitefinity CMS and Sitefinity Cloud (PaaS) setup.

For faster permission-based filtering and improved pagination, you can store view permissions directly in the search index.

To enable this, perform the following:

1. Add the following key to the appSettings section of your web.config file:
   <add key="sf:storeViewPermissionInSearchIndex" value="true" />
2. Reindex your search index.

When enabled, Sitefinity CMS adds GrantedViewPermissionPrincipals and DeniedViewPermissionPrincipals fields to the search index based on each item's view permissions.

The following limitations apply when view permissions are stored in the search index.

Administrators always see all items

Administrator users always have access to all indexed content in search results, regardless of the access groups configured on individual resources.

Owner role is ignored

The Owner role in Sitefinity CMS is not reflected in search visibility. Content ownership does not grant any special search access.

Change owner, Change permissions, and Unlock are not observed

Only the View, Create, Modify, and Delete permission types are mapped to access groups. Actions such as Change owner, Change permissions, and Unlock have no effect on what is indexed or returned in search results.