Security is the protection of information and property from theft.

learn more… | top users | synonyms

1
vote
1answer
48 views

Strange SharePoint behaviour regarding “Check Permissions” in a web part

I have a web part in which I am displaying users from User Profile Service which is synced with AD. In my code I get all the users in current site and then see if they are part of any group. If they ...
1
vote
0answers
20 views

Fine-tuning SP2013 Document Library permissions

I have the need to give access to a role for creating documents and folders in a document library and giving access to another role to create documents (but not folders) How would I go about doing ...
1
vote
0answers
88 views

FBA Custom login page to use 2 factor authentication - simplified

User provides an username/password. Should validate those and only then proceed to step 2. User provides an additional authentication token. If succeeds user is authenticated against SharePoint and ...
1
vote
1answer
129 views

Why the security trimming doesn't apply?

It seems that the security trimming doesn't apply for the Quick Launch in SharePoint 2013. I've created 2 lists with broken role inheritance and assigned permissions to a different group for each ...
1
vote
0answers
25 views

Log sharepoint security events to the windows event log

Is it possible, through either a configuration setting or some minor conding, to make SharePoint log all security events to the Windows Event Log? I'm primarily interested in events that deal with ...
1
vote
2answers
72 views

SP_Admin SQL Permissions

I'm trying to create a web application using powershell and I'm getting a log in error with the SP_Admin account. I'm not sure if I've made a mistake when I was setting up the environment, I might ...
1
vote
0answers
31 views

In SharePoint 2013 is there a security group that allows full access to all content in a farm by default?

I'm setting up a SharePoint 2013 development server and I've added my account to the Farm Admin group. In prior versions this meant that I had access to all content in the farm by default. It looks ...
1
vote
0answers
145 views

How to restrict access to edit attachments in lists?

We have Windows SharePoint Services 3.0 SP 3 (12.0.0.6608 from CA) on Windows 2003 Server R2 EE. In the main we use our WSS as sort of book of problems. And by book of problems, i mean that there is ...
1
vote
1answer
81 views

sharepoint hosted app pages authorization

I have multiple pages in a SharePoint 2013 hosted app. I need to restrict access to some of the pages to certain group. what is the best practice to do this?
1
vote
0answers
22 views

I can add users to the Active users in the portal, but not to People and Groups - Sharepoint 2013 on Office365

I'm using SharePoint 2013 on Office365. I've added two users in the Admin Portal, both with identical attributes (except name, email address etc.!) However, when I go onto my site and try to add ...
1
vote
0answers
996 views

IE warning - Microsoft Office Contact Retriever

When I open a SP 2010 page with IE 10 on Windows 8, I get this warning: Internet Explorer Security A website wants to open web content using this program on your computer: Name: ...
1
vote
0answers
215 views

Are SharePoint 2007 or 2010 vulnerable to cross-site request forgery out of the box?

An IBM Rational AppScan against a WSS 3.0 installation indicates that it has detected a cross-site request forgery (CSRF/XSRF) vulnerabilities on many pages, for example ...
1
vote
1answer
63 views

Default Security Groups on Site Creation from Web Service

I am creating SharePoint Team Sites using SharePoint Web Services as I cannot use the object model for this solution (I do not have SharePoint installed on the server where the sites are created ...
1
vote
0answers
175 views

Steps to deny anonymous access to _vti_pvt directory iis7

The service.cnf file found in the _vti_pvt directory has the default permission settings which may lead to an unauthorized access to the file What are the steps to deny anonymous access to _vti_pvt ...
1
vote
0answers
85 views

Why is AddComment on SocialCommentManager throwing SPException?

When I try to add a comment using SocialCommentManager, the AddComment method throws an SPException saying "The security validation for this page is invalid. Click Back in your Web browser, ...
1
vote
1answer
79 views

Sharepoint: Retrieve info on assigned user policy

A question from stackoverflow Case: Create a User Policy in SharePoint 2010 Web Application Management: assign 'Full read' to user XXX for site YYY; Call SiteData.asmx/GetContent for site YYY and ...
1
vote
0answers
48 views

Is use of PageView web part poses a security risk?

I have two internal web applications in same domain, I want to integrate them within sharepoint using a PageView webpart. Some how the security community of the organization believes it would ...
1
vote
1answer
244 views

Webapp design for internet, intranet and extranet?

I am a beginner in Sharepoint and I must conceive a Sharepoint solution. I need to have an Intranet for employees as well as an access point for collaborators to a particular site in this intranet. ...
1
vote
1answer
103 views

Encrypting the search index(es) - any advice?

I have read up on how to configure SQL Server TDE to encrypt SharePoint content that resides in databases, but what about encrypting the search indexes (which reside on the file system)? Does anyone ...
1
vote
1answer
260 views

SPUtility.GetPrincipalsInGroup not working when claims authentication is enabled

Method SPUtility.GetPrincipalsInGroup can be used to resolve users that belongs to a AD Group. However, when claims authentication is enabled, this method doesn't work as expected. Is there another ...
1
vote
0answers
1k views

Why does a workflow cancel with “access denied” for all but users with Full Control accesse?

I am working with an existing SharePoint deployment that has a convoluted security structure. After cleaning up permissions a bit, an approval workflow for absence requests is somehow not working for ...
1
vote
1answer
1k views

Exception occurred while connecting to wcf endpoint

I get very strange exception "exception occured while connecting to wcf endpoint .... access denied". only when I go to any Document Library. I logged on as Administrator and I have added "Full ...
1
vote
0answers
397 views

Get Permissions with client object model

i want to add a permission on a folder who's inside a document library with javascript/jquery/client object model. The problem i have is, its a custom permission level created when some feature is ...
1
vote
1answer
176 views

Authentication - multiple web domains

We use claims based authentication and have one application running, say www.abc.com This application authenticates against AD via claimns provider. We would like to deploy another web site: ...
1
vote
2answers
199 views

How to remove same session value for different sessions?

I received an error from the Security testing team as follows: It was observed that same session value is used for different sessions. After logout, session value should be cleared and the user ...
1
vote
0answers
38 views

Secure Data from Farm Admins and Database Admins

I am working with a client whose farm admins and database admins may not be approved to view information in one of the site collections due to governmental regulations. Therefore, he would like to ...
1
vote
0answers
659 views

Importing site gives “Security check failed in OnFolderImport” error

I'm using the SharePoint Content Deployment Wizard (2.8 beta) and have successfully exported a site. Now I'm trying to import the site and it gives me the following messages in the log and isn't ...
1
vote
2answers
459 views

Best practices on Intranet & Extranet

Should these 2 be on same farm (so that deployment is not a big issue or file share) How is the security managed? Is there any good article that can help me determine best practice?
1
vote
0answers
254 views

Editing navigation from site Actions results in error in MOSS 2007

When I or any other user on any machine tries to change the navigation through Site Actions - Modify Navigation, an error occurs stating "The security validation for this page is invalid. Click ...
1
vote
1answer
177 views

Basic authentification only for a specific listening ip address?

One of my customer has a requirement which is to allow basic authentication because a outdated SSO and reverse proxy tool (changing this is not an option today). This is true for external access (both ...
1
vote
1answer
3k views

InfoPath forms not working when ViewFormPagesLockDown enabled

We have an internet facing, SharePoint 2010, Publishing Site that is accessible to anonymous users. On this site, we have some InfoPath 2010 List forms, exposed using the InfoPath Form Web Part, that ...
1
vote
1answer
851 views

SharePoint 2010 list view caching to bypass 1000 item security scope limit

my current customer has a setup where he has multiple related lists and libaries. the structure is something like the following: An Audit Item has 0:n Issue items has 0:n Documents An Issue has 0:n ...
1
vote
2answers
1k views

SharePoint 2010 Insights (PerformancePoint): '401 Unauthorized' error on invoking 'Run Dashboard designer'

Environment: SharePoint 2010 on Windows 2008 R2 Standard + SQL Server 2008 R2 I am trying to setup the BI infrastructure Lab as outlined in this article: ...
0
votes
3answers
1k views

Securing SharePoint for External Access

We are exploring the possibility of making our Intranet available to our employees outside of our network (and not over VPN). Besides firewalls/forward proxies and such (like the Threat Management ...
0
votes
1answer
2k views

jQuery SP.JS objects to test if current SharePoint user has full control / owner rigths?

As an example, the below jQuery displays current SharePoint user title. Excellent! :) Is it possible to use the sp.js objects to test If the current user has Full Control on the current page or ...
0
votes
1answer
69 views

Can SPPersistedObject settings be updated by normal users if ran with elevated privileges?

I have a custom ribbon icon "Enlist" deployed to each document library. A normal (i.e. non-admin) user can click this icon; when he does, I would like to permanently save the document library ...
0
votes
3answers
2k views

How to get user security group name through javascript

I use the following code in javascript to display name of logged in user. SP.SOD.executeFunc('sp.js', 'SP.ClientContext', getUserData); Is there a code that will also tell me security group of ...
0
votes
2answers
354 views

Is an UpdatePanel a bad decision?

After talking to a few people, and asking around here, I feel like the only way to securely do calls asynchronously is with an updatepanel. (Context: Creating an Upvote/Downvote system on SharePoint ...
0
votes
2answers
652 views

Sharepoint SPWeb rename - Exception SPException - The security validation for this page is invalid

When attempting an SPWeb rename I receive the following SPException: Exception SPException - The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and ...
0
votes
2answers
4k views

Stop inheriting permissions programatically

I want to set read permissions to some sharepoint groups to a list. For existing sites I did it manually, Stop Inherit permissions. Then on groups I chose the groups and edited their permissions, ...
0
votes
2answers
205 views

Is it possible to grant security roles through an event receiver?

I have a requirement to grant a department contribute to their department parent & child sites. The catch is, they also want to be able to grant & remove contribute to outside department ...
0
votes
1answer
26 views

Can Active Directory Upgrade lead to problems with SharePoint?

Are there compatibility issues between SharePoint version and Active Directory version? I have a scenario with MOSS 2007 and Active Directory 2000. I will upgrade Active Directory to 2012. I ...
0
votes
3answers
140 views

Denying the manage rights permission

I'm trying to fullfill a requirement which forces the use of Active Directory groups. I'm having issues getting to where I want to be. Upon creation of a new site, I'm going to use AD groups to ...
0
votes
3answers
4k views

removing NT AUTHORITY\authenticated users vs all authenticated users and adding domain group instead

I have a root site collection and under the "Style Resources Readers group" i have the NT AUTHORITY\authenticated and the all authenticated users . Are these the same groups but with different ...
0
votes
3answers
427 views

Access Denied for SPUserCollection.remove()

Works for administrator but not working for a normal user. I even tried it with "SPSecurity.RunWithElevatedPrivileges(delegate() {});" after breaking RoleInheritance, and even tried ...
0
votes
2answers
301 views

LINQ to SharePoint and SPUserToken

When creating a new Linq to SharePoint context, normally we don't pass a site object but we provide a request url. So what should I do if I want to execute Linq queries under a different user ...
0
votes
2answers
123 views

Different security for foms and lists?

Is it possible to have security so that anyone can fill out a form, but only a small amount of people can see the underlying list? We are implementing an form that can contain sensitive information ...
0
votes
1answer
71 views

CSOM Form based authentication Security issue

I'm new in sharepoint development, I was looking for authenticating users via CSOM by using forms based authentication and I found below code. ClientContext ctx = new ...
0
votes
1answer
65 views

How to use versioning when using same .snk file for multiple SharePoint projects in the same solution?

I am trying to find the right way to set up my SharePoint solution with miltiple projects (in VS2012). In that, I am having difficulty understanding the concept of reusing the strong name key file. ...
0
votes
2answers
43 views

Disabling direct access to list and library

I have a publishing site in which there are several lists and libraries. I am displaying some list and libraries on home page and applied XSLT on them to give them desired look and feel. There is a ...