Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

If you set the SPList.Hidden property to true, the list isn't shown in the Quick Launch, All Site Content, Lookup lists, etc. However, it is still possible to navigate to the list by typing in the list's URL, or by using an old bookmark.

So how do you actually hide a list, so that it won't display under any circumstances?

share|improve this question
2  
SPList.BreakRoleInheritance(false) ? –  Vedran Rasol Jan 26 '12 at 15:00
    
@VedranRasol: Not a bad solution, but I'd rather avoid stripping all the permissions if possible. –  Stuart Pegg Jan 26 '12 at 15:04
    
I don't understand the point of using a list if no one is supposed to be able to see it. Why not just create a database / table? –  ToddersLegrande Jan 26 '12 at 17:02
    
@tylerrrr07: The data needs to be accessed programmatically by web parts, but not directly through the UI. Also, I should mention that this is for a 3rd party solution (where we're the 3rd party), so requiring direct SQL Server access is generally considered a faux-pas. –  Stuart Pegg Jan 27 '12 at 8:40
add comment

5 Answers

up vote 5 down vote accepted

I ran into the same requirement in a recent project, basically preventing access to any list view or form of a particular (hidden) list via the Web browser.

SharePoint designer isn't allowed on Web Application level and Web services (including client object model) is blocked by a custom HTTP handler, so the concerns mentioned in other answers didn't apply to this project.

Removing permissions was not an option because lookup fields of the list are used on other lists and should work for anybody, but accessing the list itself shouldn't be possible.

Instead of the tedious task of messing with URL-rewriter rules on the IIS server or a custom HTTP handler, which has several disadvantages as described later, the solution was to develop a custom SharePoint DelegateControl as described here

https://littletalk.wordpress.com/2010/11/18/create-an-additionalpagehead-control-packed-into-a-feature-in-visual-studio-2010/

The DelegateControl contains code to check for a particular SharePoint group membership. If the current user isn't a member the following code blocks access to the list view & forms ASPX pages (note that the code has been simplified and might need more polishing):

string currentUrl = Request.Url.ToString().ToLower();
SPWeb currentWeb = SPControl.GetContextWeb(Context);
SPList currentList = SPContext.Current.List;

if (!currentUrl.Contains("/_layouts/") && (currentList != null && currentList.Title == "Your List Name"))
{
    Response.Clear();
    Response.StatusCode = 403;
    Response.Status = "403 - Forbidden";
    Response.StatusDescription = "Access is denied";
    string accessDeniedPage = SPUtility.AccessDeniedPage;
    string redirectUrl = "/_layouts/" + accessDeniedPage + "?Source=" + currentUrl;
    Response.Redirect(SPUrlUtility.CombineUrl(currentWeb.Url, redirectUrl), true);
}

Unlike a custom HTTP handler the custom SharePoint DelegateControl will only fire its code when an ASPX page is hit which IMHO is a big advantage because the HTTP handler fires on every single request (even a JS/CSS/GIF etc. file) which puts additional load on the SharePoint Web frontend, plus the deployment of a HTTP handler is cumbersome because it has to be added to each web.config (including each extended Web Application) either manually or by writing a proper custom feature event receiver handling all the web.config modification heavy lifting. Because of those reasons I take HTTP handlers only as last resort ;-)

The above approach is working just fine even on a high volume Web site for more than a year now.

share|improve this answer
    
This is an excellent suggestion. –  Stuart Pegg Jan 27 '12 at 8:46
2  
I've created a normal WebControl derivative, which I've inserted directly into the custom master page. Works beautifully, thanks. –  Stuart Pegg Jan 27 '12 at 11:27
add comment

You can access all sorts of things in SharePoint by typing in a url or by merely changing the querystring. If the list must be hidden always, then change security on the list so that only those with proper permissions can see it.

If you really are set on this, you can also implement some form of URL Rewriter on the IIS server hosting SharePoint and block requests for that list, though that can be a bit annoying to maintain across a farm.

share|improve this answer
add comment

Hmmm... couple of ideas come to mind, although neither is particularly awesome.

1) Create a custom HTTP handler that detects if a user is browsing to one of the list url's and redirect the user

2) Link a javascript file in your master page that does the same thing (checks the url to see if it contains /Lists/YourList) and redirect the user somewhere else.

There may be a more elegant approach, but I'm still drinking my first cup of coffee...

The problem is, that the list EXISTS.. so unless you set the permissions where NO ONE can get to it, a user that knows the url can get to it.

good luck, Mark

share|improve this answer
add comment

You can't. You can however remove all permissions so that no one besides SiteCollection administrator have access to it.

share|improve this answer
add comment

It should be pointed out that, without touching the permissions, just because it is hidden or redirected in the UI does not mean it is not accessible through other means.

SharePoint designer, web services, object model, etc. will still see it. It's the old 'security through obscurity' discussion.

If hiding is all you want, SPList.Hidden and Mark's 2nd option will do it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.