We have a MOSS 2007 site where the Visitors are allowed to personalize their home page. They are allowed to add only 2/3 webparts and we did this by managing permissions in the Web Part gallery.
This works fine. A normal user is able see only 2/3 webparts in the Add WebPart window.
I log in as a normal user. Add WebPart dialog shows only 3 Webparts which is good but if I add the query string "Toolpaneview=2" to the URL I will be redirected to the Edit mode which has options to Add Webpart (Similar to http://blog.drisgill.com/2008/10/extremely-helpful-hidden-web-part-menu.html )
This has "Import" option which will let me upload WebPart or dwp files and add it to the page. is there any way to block this option?