Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a custom ASPX page in WSS 3.0 which I use to capture email addresses. These emails are stored in a list called Notificiations using nothing but jQuery and SPServices. Because I'm using jQuery and SPServices, I can't use elevated privileges so everybody has to have read/write/delete access to this list.

So I'm trying to figure out what the best method is to prevent somebody from getting to the AllItems.aspx page for this list to seeing the content. I don't see anything stopping a clever user from going to http://somesite/.../Lists/Notifications to see what's there. I've tried to insert some jQuery to hide the webpart but that doesn't stop the email addreses from being seen if "View Source" is selected for the page.

I can check permissions on the page for the current user. If they don't have full permissions, should I redirect them somewhere else? The administrators should still be able to see the data and edit as usual.

Any tips/ideas here is really appreciated.

Thank you very much, dave

share|improve this question

5 Answers 5

up vote 1 down vote accepted

Down the path of your jQuery route, instead of hiding the web part, you could have your jQuery simply remove all content of the web part div. So if you are trying something like $('#webpartDiv').hide();, you could instead remove the html contents $('#webPartDiv').html("");

Another alternative is to set an authorization rule in your web config deny access to any pages within the Notifications directory

<location path="/Notifications">
    <system.web>
        <authorization>
            <deny users=*" />
        </authorization>
    </system.web>
</location>
share|improve this answer
    
the $("#WebPartWPQ1").html(""); worked. Thank you Tim. –  DrZ Jun 1 '11 at 11:23

Follow these steps:

  1. Create another view and change the default view to this view
  2. Set permissions for the list from List Settings as 'Limited Contribute - default view' for all users except admin.

Edit: 3. Go to Site settings -> Permissions -> Permission levels and create a permission for only viewing the default view.

If this does not help:

  1. Open the list and create 2 views. 1 for normal user which should be the default one.

  2. The other view is for admin and it should be with a different name and give all columns and conditions as of the view 'All Items' [Give a name for the view that users cannot guess]

  3. Delete the view 'All Items' [This is to avoid users from getting the view when they type 'All items.aspx']

  4. Open the list in the 1st view which is default for all other users.

  5. Type 'pageview=shared&toolpaneview=2' at the end of the url and modify the web part.

  6. Remove the Full toolbar view from the view options and this will disallow any user from changing their views.

  7. Give your admin the link to the second view directly.

Hope this helps :)

share|improve this answer
    
Deepu, what is Limited Contribute? Where would this be configured? Thank you! –  DrZ May 31 '11 at 15:56

Change the filter options for AllItems.aspx such that it returns nothing, that should do it for you.

Nobody should be able to modify or create new views of the list, so this might be enough for you.

share|improve this answer
    
Thanks James. I did try this. But then the administrator couldn't see any of the items. I ended up with 2 views (one with the filter and one without) but it then didn't stop the users from choosing the other view. I should have been more clear in my original post. –  DrZ May 31 '11 at 15:12
    
This might help, then: dsen-25.blogspot.com/2011/03/… - read the details on the TechNet page that's linked there, too. –  James Love May 31 '11 at 15:30
    
Another great idea but we're not using anonymous access. The users all have AD accounts and must use them to log in. We just don't want those users getting to this data. I really appreciate you taking your time James to help. I'll keep investigating further. Thank you. –  DrZ May 31 '11 at 15:53

You may edit (or add one and edit) the Role definition associated with your group :

if you remove the "View Application Pages", it will prevent these actions :"View forms, views, and application pages. Enumerate lists".

So the users won't be able to view the content of the lists.

share|improve this answer

You can configure the list view webpart that is embedded in the page to display content with admin rights only.

share|improve this answer
    
Can you please add som details to this answer, to make it useful :) –  Robert Lindgren Aug 11 '13 at 9:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.