Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

SharePoint 2007 Document Library has permissions set for user A to "Read". User A is able to go to Actions -> Open in Windows Explorer and delete files. This seems like a very large security loop hole.

We do not want to remove the Open in Windows Explorer option so is there any way to enforce permissions in this setting?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

I had the same feeling when using the "Open in Explorer" in SharePoint 2010. User could remove docs in the Explorer view. But when refreshing the documents were still there, so the user could in fact not delete them...

share|improve this answer
    
Thanks, this was very helpful. I had the users test this and it was true. Fears have been alleviated. –  jethomas Mar 21 '12 at 15:30
add comment

If User A is logged in as User A (Read Only) in SharePoint, but is logged into their machine as User B (Full Control) then the permissions will be different than expected. Explorer View uses the credentials of the user logged into the machine, NOT the credentials currently used in SharePoint.

This is likely what is causing the confusion (especially if you are testing on your machine). The Explorer View is still respecting the library's permissions, but you may be presenting different credentials than you thought.

share|improve this answer
    
This was on user A's own machine logged in with their own credentials. –  jethomas Mar 16 '12 at 18:26
    
Also fyi you can set Web DAV to use basic authentication: blogs.technet.com/b/manjesh/archive/2010/01/03/… This would let you choose who to login with. –  Russell Mar 17 '12 at 11:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.