Skip to main content
SharePoint

Return to Question

added 216 characters in body
Source Link
Stephen
Stephen
  • 1.8k
  • 8
  • 35
  • 56

Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?

**I should have mentioned that my app has a requirement whereby certain number of users (multiple, i.e. Manager, Approver and Director) will require access to a particular item to help in the approval process.

**

S

Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?

Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?

**I should have mentioned that my app has a requirement whereby certain number of users (multiple, i.e. Manager, Approver and Director) will require access to a particular item to help in the approval process.

**

S

Source Link
Stephen
Stephen
  • 1.8k
  • 8
  • 35
  • 56

List and list item permission and security in Sharepoint hosted App

Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?