Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have a MOSS 2007 site where the Visitors are allowed to personalize their home page. They are allowed to add only 2/3 webparts and we did this by managing permissions in the Web Part gallery.

This works fine. A normal user is able see only 2/3 webparts in the Add WebPart window.

Issue :

I log in as a normal user. Add WebPart dialog shows only 3 Webparts which is good but if I add the query string "Toolpaneview=2" to the URL I will be redirected to the Edit mode which has options to Add Webpart (Similar to http://blog.drisgill.com/2008/10/extremely-helpful-hidden-web-part-menu.html )

alt text

This has "Import" option which will let me upload WebPart or dwp files and add it to the page. is there any way to block this option?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The view from Microsoft is not to offer this feature.

If you want to avoid the risks associated with import, you can disable the feature altogether simply by not using the server control that implements it. Or you can limit what users have access to the control. For instance, you could use role management, and if a user is in the administrator role, you could programmatically add the ImportCatalogPart to the page for that user.

I can't think of anything else, unless there's a way to block uploads of dwp files using an Infrastructure trick. Otherwise you'll have to rely upon Security by Obscurity which you wisely seem keen to avoid.

share|improve this answer
    
Thanks Neil. How can I remove this Control? I coulnd't find this in the masterpage. Any ideas? –  Shoban Feb 1 '11 at 19:58
    
So I'm not sure where its getting rendered. What I would suggest is embedding a control in the page to find out just where the control is stored within the control tree. From there you will hopefully get a better sense of how to remove it. It sure seems like a bloody great security risk though. –  Neil Richards Feb 1 '11 at 21:46
    
Are you sure that restricting access to the webpart gallery isn't sufficient? Does the dwp go into the page or the gallery? If it goes into the page then I'm a bit stuck. Should also highlight that in reviewing the link posted above it refers to .net webparts and not SharePoint ones. –  Neil Richards Feb 1 '11 at 22:11
    
It goes to the webpart and not webpart gallery. The link above was for ref purpose but I am also able to upload SP webparts. –  Shoban Feb 1 '11 at 22:25
    
Sorry I meant.. the webpart goes to the page and not the webpart gallery. –  Shoban Feb 1 '11 at 22:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.