Suppose there's a top-secret list (inherits its permissions from its parent) that contains records that were created earlier by different users. There are several groups with rights to administer, read, write-constrainted.
There is a group of authors of top-secret items. Author can only create a 'secret-item'. But the item shouldn't be viewed by other participants of the group (Authors).
I can't access/change site programmatically. And I'm curious how come I do this manually.
First, keep in mind that you cannot do "top-secret" in SharePoint. The site collection administrator will always have access to all content.
Manually, there are two features that come close to your request:
under advanced options in the list settings: user can only read/write his/her own items
under the same advanced options: activate approval. Content in draft state will remain hidden (except from approvers and site owners)
In addition to the answers from #Christophe, you can also modify the permissions of individual List Items.
If you were able to make programmatic changes, I would suggest attaching an ItemAdded event receiver to a custom Content Type named "Top Secret." But in this case, the permissions changes can be made as a manual step after adding the item.
The risk, of course, is if the author forgets to change the permissions, changes the permissions incorrectly, or changes the permissions very slowly (allowing others to see it before permissions are changed).
For more information on changing the permissions of a List Item, see Break permission inheritance on a folder, document, or list item.
Related
I am trying to set up some restrictions within my Sitecore instance so that users who only have permission to create items within a subsection of a site also have the publish permission, but only have the ability to publish items where they have create content permission.
For example I have the content similar to the following:
Sitecore
|- Content
|- Home
| - WhatWeDo
| - Infrastructure
| - Training
| - Locations
| - Europe
| - North America
I have set up the Everyone role to have read permission to all items within the content tree, and I have specifically specified that they are denied write, rename, create, and delete permission
I have set up a role, "WhatWeDo" and has been granted write, rename, create, and delete permission to item WhatWeDo and its descendants.
Now if I add the "WhatWeDo" role to the Client Publishing role, then the users who have been granted "WhatWeDo" role, also have the ability to publish, but they have the ability to publish any item within the content tree. i.e. The Publish button on the Publish ribbon is displayed.
Mostly when I have tried googling this, they are talking about publishing restrictions. i.e the Publishing Settings dialog, but this is of no use to me in this scenario.
I have found this https://stackoverflow.com/a/6351649/1442308 but I cannot seem to get this working and I suspect that it is related to very old version of Sitecore and no longer applies.
I have also updated my config so that the publishing should only publish if have read and write permission
<setting name="Publishing.CheckSecurity" >
<patch:attribute name="value" value="true" />
</setting>
But this has had no effect on restricting users publishing content tree items that they should not as the user is still able to publish items within the Locations section of the content tree. i.e. The publish button is still visible on the Publish ribbon.
I need to restrict this so that those users who have been granted the "WhatWeDo" role can only publish item WhatWeDo and its descendants, and do not have the ability to publish any other item within the content tree. i.e They should only have the publish button visible when they are in the WhatWeDo item or any of its descendants.
Update
Updated question to make it clearer that I want to make sure that the publishing button is not visible on the ribbon bar.
The Publishing.CheckSecurity setting is used durring the execution of the publish, so only items that the user has access to are actually published. It does not affect access to the publish ribbon button.
Typically, people use workflow to achieve what you are looking for. Set up a workflow with a publish action. The sample workflow provided with the initial install gives an example of this. Then you can restrict access to the workflow command.
Update
The Sample Workflow that is provided out-of-the-box has everything you need to get this to work. It has the commands and the auto-publish action as well as the security settings applied for the Sitecore Client Authoring role.
Since you have already applied security to your content items, all you would need to do is assign those items to the sample workflow. You could duplicate it and rename it if you wanted. You could also rename the Approve command to Publish.
To ensure that the standard publish button does not appear in the ribbon, make sure that these users are not members of the Sitecore Client Publishing role.
(Sorry but I don't have the comments option enabled yet.)
I would definitely go for the workflows option. As mentionned in the comments, the Publish button will be enabled through the security permissions, but as a general ability, not dependent on the items permissions. If you don't want the Publish button to show up without going into fancy customizations, you should forget this option.
Instead of the classical Publish button, users would have the workflow button triggering the publish action, under the Review tab. It wouldn't change that much for your end-users. It will even get them used to the workflow actions, that you could further use and refine, later in your project. You could take this opportunity to introduce them in your project, moreover it's perfectly suiting your needs.
Don't hesitate to ask if you want more detailed explanations on how to set up such a workflow.
It's not possible hide the publish button in the ribbon out of the box for items that the user does not have access to, but it is quite simple to use the Rules Engine to control whether the button is shown or not. It will require some coding though, there is no way around that.
You can find more information in these blog posts, but there are some differences for Sitecore 7.1+ due to changes in the Rules Engine:
Rule-Based User Interface Components for the Sitecore Client
How to create a custom ribbon in Sitecore Content Editor
Limiting Conditions and Actions with Sitecore 7.1+
1. Create the rule action class
In your Visual Studio Project create the CommandRuleContext and SetCommandState classes as specified in first blog post.
2. Create the Rule in Sitecore
This is where there have been a lot of updates in Sitecore 7.1+, the third blog post explains the new structure of the rules engine:
Under /sitecore/system/Settings/Rules/Definitions/Tags create a new tag called Command State
Under /sitecore/system/Settings/Rules/Definitions create a new folder called Command States and add the 4 states shown in Step 1.14
Create a new Element Folder under /sitecore/system/Settings/Rules/Definitions/Elements called Command Rules
Insert a new Action under this folder. Set the field values as:
Text: set command state to [commandstateid,Tree,root=/sitecore/system/Settings/Rules/Definitions/Command States,specific command state]
Type: MyProject.Custom.Commands.SetCommandState, MyProject.Custom
Select the Tags/Default item and select Command State from the list of tags. This is the tag we defined earlier.
Now under /sitecore/system/Settings/Rules insert a new "Rules Context Folder" called Command Rules and then add a new rule in the Rules folder.
Before we create the rule we need to associate tags to show the conditions and actions. Select the "Tags/Default" item again and this time select Command State and Item Security. You can select different tags if you want to use different conditions (e.g. Item Hierarchy, Item Information, Security etc)
Now create the rule with condition you need, e.g.
3. Update the command to use the Rules
We need to update the code for the Publish button command to use the Rules we have defined.
Create a new command class inheriting from the existing Publish command:
using Sitecore.Data.Items;
using Sitecore.Diagnostics;
using Sitecore.Rules;
using Sitecore.SecurityModel;
using Sitecore.Shell.Framework.Commands;
namespace MyProject.Custom.Commands
{
public class PermissionBasedPublish : Sitecore.Shell.Framework.Commands.PublishNow
{
public override CommandState QueryState(CommandContext context)
{
Assert.ArgumentNotNull(context, "context");
var state = base.QueryState(context);
if (state != CommandState.Enabled)
return state;
return RunRules(context);
}
private CommandState RunRules(CommandContext context)
{
Item parentRuleItem;
var ruleContext = new CommandRuleContext();
ruleContext.Item = context.Items[0];
using (new SecurityDisabler())
{
parentRuleItem = ruleContext.Item.Database.GetItem("/sitecore/system/Settings/Rules/Command Rules/Rules");
if (parentRuleItem == null)
return CommandState.Enabled;
}
RuleList<CommandRuleContext> rules = RuleFactory.GetRules<CommandRuleContext>(parentRuleItem, "Rule");
if (rules == null)
return CommandState.Enabled;
rules.Run(ruleContext);
return ruleContext.CommandState;
}
}
}
And now we can patch in this command instead of the default one:
<configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:set="http://www.sitecore.net/xmlconfig/set/">
<sitecore>
<commands>
<command name="item:publishnow">
<patch:attribute name="type">MyProject.Custom.Commands.PermissionBasedPublish, MyProject.Custom</patch:attribute>
</command>
</commands>
</sitecore>
</configuration>
The visibility of the publish button is now based on defined rules. With the rule defined above, the button will only be visible if the user has write access to the current item they are one.
The user will still need publish permission using the appropriate roles. Note that using out of the box roles means the user will have access to the Publish Site option from the drop down as well. You need to restrict access to /sitecore/content/Applications/Content Editor/Menues/Publish/Publish Site in the Core database and the shortcut from the desktop as appropriate.
You may also want to combine this with the Publishing.CheckSecurity setting by setting it to true.
I'll add that giving users Publish rights as a general rule is a bad idea IMO since every publish, even of a single item (and this includes Auto-Publish with Workflow) will clear the HTML caches and may lead to performance issues.
How to allow a user with read access to respond to a Sharepoint 2013 Survey ?
I have tried with the read access only, but its not able to get the "respond to survey" link. I have also tried the "contribute access" option also and this time, I have got the button "Respond to Survey". When I tried to fill the survey details and click submit, I'm getting an access denied error message.
You cannot add items to a list (usually what is meant when you say "respond to a Sharepoint survey") with only Read permissions. Users will need either Contribute permissions or a custom permission level that includes Add Items. It is also important to distinguish the site or list that you're setting permissions for: when you say that you have "contribute access", you may only have set Contribute permissions for your site. You need to set it for the list that contains the survey results.
Lists usually inherit permissions from their parent sites, but it is often prudent to stop inheriting and set custom permissions on lists (like surveys) that everyone will need to contribute to. That will keep users in other directorates/groups/teams from mucking with the Shared Documents library (and many other things) of whatever directorate/group/team is hosting the survey.
Lists can be set up to handle access requests so that the "access denied error message" you received will include a link to request access. This may be a feature to consider on your survey to simplify the resolution of future permission errors.
I have a List to which users have contribute rights
I have a Event Handler which changes the Item Level Permissions on adding or Updating events on list by
2.a CurrentlistItem.BreakRoleInheritance(true);
2.b and by adding users to that list
Now above does not work if user who is adding has rights of contribute
but works if users has full control.
I think a solution could be to run these privileged calls by system admin user.
How can i solve this problem , Please guide, Thanks.
//Amit
Have you tried RunWithElevatedPrivileges? Just remember to run as little code as possible within it.
Just running your code using RunWithElevatedPrivileges is not enough. Credential info is kept inside the SPSite object that is used directly or indirectly by most SPxxxx objects, including SPWeb, SPListItem etc. In order to modify item permissions you will have to recreate any SPSite, SPListItem, SPWeb you use inside RunWithElevatedPrivileges, using only the IDs provided by the event handler.
we created one page and placed under LAYOUTS folder.so can u tell me can all users access this page by giving their AD credentials.
some users are not able to login to this page.
pleage give me some suggestions.
The default Application Page setup will require the View Application Pages permission, and all derived permissions. You can manually configure the permissions of the application page by defining the RightsRequired property of the page. This is usually defined OnLoadComplete, but you can specify to occur after OnPreInitComplete by configuring the RightsCheckMode property.
But, without fiddling in these settings, it is still possible that certain users who have the read permissions on the general site may be barred from the Application Page. This can arise whenever you have controls that require different permission levels. For example, if you have a custom application page that has a field control associated with a specific list and item, if that control is in Edit mode then the user needs Edit permissions for that list and item in order to view the application page. It does not actually matter if this field control has anything to do with the list in question! For example, I once had an application page designed for bulk-downloading files which are in two folders. I wanted to re-use this page for a few different document libraries, so I decided to create a custom multi-lookup field control that would take the List query string as if on a New Form, and build the list of items to download that way. But this page was blocked for a subset of users who were not allowed New item permissions in one of the two folders, even though the page technically didn't do anything involving adding new items.
Any other elements on the page which require a separate set of permissions than general site permissions will also interfere, but the general case is with item-level and list-level permissions conflicting with the site-level permission. Simply check all of your controls, especially ones based on SharePoint web controls. As long as the user has permissions necessary to operate all of these, the user should be able to view the application page.
The entire user who has read permission, they can access this page.
If this page trying to do any manipulation, which needs hire permission, you may get access denied.
For trouble shooting comment all cods and try to access this page with read permission.
I have a list which I've set item-level permissions on. I set it to allow users to read all items and only edit their own items...
The issue is that if I do this then I can still edit all items...
If I change it so that I can only read my own and only edit my own then it works as expected...
Anyone have any thoughts on why this would be occurring and a solution...
I've set the list up to only allow one user account with contribute rights for testing purposes...
when you change permission in a list Advance Settings, it still let contributors to go to EditForm but once contributors try to save item, that doesn't belong to them, it show error message that you don't have permissions.
give it a try, create an item by some user let say User1, then try to modify that item using User2 credentials (User must have only Contributor right on the site/list), it will let you go to EditForm but wont let you save item.
I hope it helps you.
Are you a list manager (e.g., a site owner)? List managers have extra permission.
This only works if your user does not have permissions to edit all items on the list by based on the site permissions. E.g. if your users has contribute permissions to the site, that will override the individual item permissions.