1

I have an internet site using MOSS 2007/win 2008/SQL 2005. Users are authenticated using forms authentication.

All authenticated users are able to browse pages like: /Style%20Library/Forms/AllItems.aspx or _layouts/viewlsts.apsx

They can view XSL files and even download a copy of it.

How can I restrict users from accessing these pages without affecting their browsing experience?

Note: I have activated the ViewFormPagesLockdown feature and made sure anonymous users are not able to access these pages.

Improve this question

1 Answer 1

Reset to default
1

As you say ViewFormPagesLockdown affects anonymous users only. What the feature really does is remove ViewFormPages right from Limited Access role:

SPRoleDefinition guest = mySite.RootWeb.RoleDefinitions.GetByType(SPRoleType.Guest);
guest.BasePermissions &= ~(SPBasePermissions.EmptyMask | SPBasePermissions.ViewFormPages);
guest.BasePermissions &= ~SPBasePermissions.UseRemoteAPIs;
guest.Update();

You could use the same code to remove these permissions for the role types you dont want this access to.

Improve this answer
2
  • you mean i need to create an EXE for example that does this action and run it against the sites that need to be secured?
    – Emad Gabriel
    Commented Mar 1, 2010 at 11:44
  • i would probably go for a call-out (feature receiver) that modified the role. This gives you both better provisioning and the possibility to reset the rights on feature deactivation: guest.BasePermissions |= SPBasePermissions.EmptyMask | SPBasePermissions.ViewFormPages; guest.BasePermissions |= SPBasePermissions.UseRemoteAPIs; what you will need to determine first though is what SPRoleType you want to revoke these permissions from...
    – Anders Rask
    Commented Mar 1, 2010 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.