Restrict Content publishing for user have read only access to content

We have a multisite Sitecore instance, and we have created different roles for each site for content authoring, we have not used workflow. 

The user from one site can view the read-only content from another site but is he able to edit only their site alone. 

Recently one of the content author published the Sitecore/Content with Publish subitems selected this results in publishing all the content from another site as well which are not supposed to be published. 

So we thought of restricting this behavior. 

we have an option to restrict the user from publishing the content who does not have rights.

   <setting name="Publishing.CheckSecurity" value="true" /> 

unfortunately, the above option won’t work for us, as the above setting will still publish the content if the user has read access to the content.

So, I have created a custom pipeline to hide the publish button from the ribbon for the user content that has read-only access.

 

using Sitecore.Shell.Framework.Commands;

using System;

using System.Collections.Generic;

using System.Linq;

using System.Web; 

namespace Assembly.Pipeline

{

    /// <summary>

    /// Resticting publishing of the sitecore item only to user and 

    /// item has write access byremoving publish button from the ribbon

    /// but enabling that button to write access provided user and item with 

    /// the combination of <setting name="Publishing.CheckSecurity" value="true" />

    /// </summary>

    public class PublishingRestrictionForReadOnlyUser : PublishItem

    {

        public override CommandState QueryState(CommandContext context)

        {

            var item = context.Items[0];

            var baseState = base.QueryState(context);

            return baseState == CommandState.Enabled && item != null && 

                !item.Security.CanWrite(Sitecore.Context.User)

                ? CommandState.Hidden

                : baseState;

        }

    }

}

Patch config:

 

<sitecore>

   <commands>

     <command name="item:publishnow">

       <patch:attribute name="type"> 

            Assembly.Pipeline, AssemblyName

        </patch:attribute>

      </command>

    </commands>

</sitecore>

After deploying the above code and config, now the user can publish only their dedicated site content alone, as the Publish button will be hidden for the user who has read-only access to the content. 

Output:

 

For Readonly content

Write access Content:

Once done, we need to remove the Publish Site option from the Desktop menu and from Publish button in the ribbon.

Go to the core database and deny the Publish site item for Sitecore Client Publishing role.

That's it :)