Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Have a document library in MOSS 2007. Item-Level permissions are not surfaced in the default SharePoint UI for Document Libraries, however the WriteSecurity and ReadSecurity properties are available from the SPList corresponding to the list in the OM.

We have set our Document Library for WriteSecurity = 2 (only their own) through code.

When I perform a functional test on this, however, I am able to delete another user's documents.

While researching this, it looks like there is a few popular blog posts indicating that setting the WriteSecurity property through the OM should be sufficient, such as this one here:
http://blogs.pointbridge.com/blogs/morse_matt/Pages/Post.aspx?_ID=8

It appears, however, that SharePoint isn't respecting this setting for Document Libraries. I've confirmed it does for at least one other list type: Links.

Is the solution to create an event receiver to do one of the following:

  1. On the "Before" Delete/Edit events, ensure the user performing the action is the appropriate person, and if not, cancel the event?

  2. On an Item Added "After" event, remove all permissions from everyone but the person who created it.

Also, does this story get better with SharePoint 2010?

share|improve this question

1 Answer 1

The read/write security settings do not apply if you have the 'manage lists' permission on the list. Did you try your test using a low privileged account?

share|improve this answer
    
Yeah, I confirmed that there are no higher level perms. The users both have the following in their permission set: Add Items Edit Items Delete Items View Items Open Items View Versions Delete Versions Create Alerts View Application Pages I also tested the same set of permissions on a Links list and it worked as expected (i.e. user was not able to delete other user's link). –  Brian Aug 19 '10 at 22:34
    
Ok... I tested it myself and it looks like the WriteSecurity property is ignored on document libraries (if ReadSecurity is set to 2 though it works). Perhaps that is why the property is not availble through the UI. –  Paul Lucas Aug 20 '10 at 0:32
    
Right, so I don't understand why this blog post (though old) makes it seem like it should work: blogs.pointbridge.com/blogs/morse_matt/Pages/Post.aspx?_ID=8. Guess you cannot just take what you read on someone's blog as truth. So, assuming this is correct, what is the best way to achieve this? One of the options I suggested? Other? –  Brian Aug 23 '10 at 3:03
    
Yep the difference with the referenced blog post is that he is setting both the ReadSecurity and WriteSecurity to 2. In that case it will work, because you cannot get access to another users documents in order to delete them. As you suggest, I'd try going with an event receiver for the library to set permissions. –  Paul Lucas Aug 24 '10 at 2:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.