Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have an event receiver on a task list that gets the assigned to people, and grants them 'full control' on that item. Below is the method the event receiver fires, on add and update:

public void AddFullControlUsersToItem(SPWeb subsiteWeb, SPListItem item,     List<SPFieldUserValue> assignedUsers)
    {
        try
        {
            //remove all item permissions
            while (item.RoleAssignments.Count > 0)
            {
                item.RoleAssignments.Remove(0);
                item.Update();
            }

            //add permissions to this listitem for the assigned users
            foreach (SPFieldUserValue user in assignedUsers)
            {
                // create role assignment and definition
                SPRoleAssignment assign = new SPRoleAssignment(user.User);
                SPRoleDefinition def = subsiteWeb.RoleDefinitions[DefaultSettings.S_PERMISSION_FullControl];
                assign.RoleDefinitionBindings.Add(def);

                // add user permission to subsite
                item.RoleAssignments.Add(assign);
                item.Update();
            }
        }
        catch (Exception ex)
        {
            throw new SecurityException("Intervate.CMS.Administration.Security.SecurityRepository", "AddFullControlUsersToItem", "Could not add Full control users to items", ex);
        }
    }

I have noticed that this has the side effect of adding those users directly into the site permissions, with limited access.

User permissions on site level

However when I remove this user from the item (which removes the users permissions) they stay in site permissions :| ??

So I have two questions:

  1. Is there an error in the way I am assigning / removing the permissions that is causing this behavior? and
  2. If there is, how should I fix this?
share|improve this question

1 Answer 1

up vote 1 down vote accepted

This is SharePoint functionality as designed. SharePoint need to acknowledge Limited Access on sites above the item to allow let-through permissions to the item.

By using SharePoint groups you can avoid this behaviour by doing the following:

  • Create a new SharePoint Group. Assign permissions for the item to the SharePoint group. The group contains the users.
  • Remove permissions from the item to the SharePoint group and remove the group.

Since the group is removed entirely from the Site Collection, the Limited Access permissions are not present.

share|improve this answer
    
Thanks for this, I think we are going to just have to accept this behavior. It will become a complete management nightmare as more items are added to the list, and the users assigned rights to those items are added to the site level permissions. –  Mahendran Govender Jul 9 '12 at 15:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.