Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Considering the following scenario : - create a SharePoint site collection - create a new security permission level "Test", with "Manage permissions" checked. - create a new Group, with "Contribute", and "Test" checked for its permissions.

Now, if a member of this group goes to "_layouts/user.aspx", he can modify his group permissions, and check "Full Control". Now he is site admin.

Is there a way to prevent this behaviour ?

share|improve this question
add comment

migrated from stackoverflow.com Mar 27 '12 at 16:13

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote accepted

I assume you mean "Manage Permissions"? So as far as I can tell, there is no permission for "Let people manage the permissions of others but not be able to give anyone higher permission than they have"... "Manage Permissions" is effectively "Full Control".

SPSecurityTrimmedControl won't really help because it just changes what the user can see, not what they can do. They could still use webservices or the API to manage permissions.

share|improve this answer
    
Yes but it's for very end users that aren't likely to use webservices/api :) Still an issue for me, that a group can "raise" its permissions on a site/web –  mathieu Sep 20 '08 at 19:04
    
It is true that you can hide actions from naive users easily in Sharepoint with SPSecurityTrimmedControl, but take care because you are still leaving a security hole that may not be easily noticed by site maintainers. –  barryd Sep 21 '08 at 18:13
add comment

You can use a SPSecurityTrimmedControl to prevent displaying the group list to anyone but Administrators, but as it is a page located in _layouts, it can be overwritten by a service pack, so I think it is not best practice.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.