Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I've create the Web Part for SharePoint 2010, which contains simple custom property with PersonalizationScope.User. Web part inherited from the System.Web.UI.WebControls.WebParts.WebPart

private int _mainBodyBorderWidth = 0;
    [Personalizable(PersonalizationScope.User),
     WebBrowsable(true),
     WebDisplayName("Main Body Border Width"),
     WebDescription("Set main body border width"),
     Category("Style")]
    public int MainBodyBorderWidth
    {
        get
        {
            return _mainBodyBorderWidth;
        }
        set
        {
            _mainBodyBorderWidth = value;
        }
    }

When Site Administrator or users with permission Add and Customize Pages click "Personalize Page" and than "Edit My Web Part" this property is displayed in the web part tool pane. However users with standard permission level "Contribute" can't see this property.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

After reading this article and some investigation I get following results about SafeContol tag for the web part. The following considerations must be applied for the web part which user without permission Add and Customize Pages can add/remove or modify.

  1. In SP 2010 TypeName attribute of the tag should use particular type name instead wildcard.
  2. Attribute Safe set to "True"
  3. Attribute SafeAgainstScript also set to "True" And SafeControl tag will look similar to this:

<SafeControl Assembly="Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" Namespace="Microsoft.SharePoint.WebPartPages" TypeName="ListViewWebPart" Safe="True" SafeAgainstScript="True" />

However VS 2010 by default generate wildcard "*" for the TypeName attribute, and "False" value for the SafeAgainstScript attribute of the Web Part item. So you need change in the Web Part item Properties Safe Control Entries collection entry with particular type name and "SafeAgainstScript" property right value.

share|improve this answer
add comment

The default SafeAgainstScript=false provides protection against XSS attacks.

When switching this attribute to true you need to be aware of the implications.

This article provides a good summary

Haytham speaks from Microsoft

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.