Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

It appears as though Sharepoint 2010 OOB does not give Authenticated Users "contribute" permissions for users' blog comment lists. Authenticated Users only have the permission to read, which is not ideal in a corporate setting. Our employees want feedback to what they post on their my site blog.

How would you recommend changing this permission? We have already created a little utility to go through all the existing user profiles and change the permission on their comment list. But what about when a future user sets up their blog for the first time? Is there a way to change this default permission setting for future users?

My only idea at the moment is to set up an event receiver for when a new site is created. But then it would run every single time that a site provisions and it would have to check to see if it's a blog site.

share|improve this question
add comment

2 Answers 2

I've done exactly this actually. Like @Paul Lucas said, just create a feature and staple it to the Blog site definition. Here is the code that should live inside your feature receiver:

using (SPWeb web = (SPWeb)properties.Feature.Parent)
{
    // Grant all read-only users contributor access to the Comments list.
    SPList commentsList = web.Lists["Comments"];

    if (!commentsList.HasUniqueRoleAssignments)
    {
        commentsList.BreakRoleInheritance(true);
        web.AllowUnsafeUpdates = true; // NB: BreakRoleInheritance() resets this flag so we need to explicitly set it again.
    }

    SPRoleDefinition roleDefinition = web.RoleDefinitions.GetByType(SPRoleType.Contributor);
    SPRoleAssignment roleAssignment = new SPRoleAssignment(web.AssociatedVisitorGroup);
    roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

    commentsList.RoleAssignments.Add(roleAssignment);
    commentsList.Update();

    web.AllowUnsafeUpdates = false;
}
share|improve this answer
add comment

@Sabrina, an alternative to your idea of an event receiver would be a custom feature with a feature receiver that sets up the permissions. You could then use feature stapling to staple the feature only to blog sites.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.