Is Security Trimming Possible in the Script Editor web part?

Question

PROBLEM: I have a single web page in SharePoint that I want to Security trim. Since it's a one-off page, I don't want to change the master page I just want to lockdown this specific page using the Scripts web part. I've successfully been able to hide various parts of the SharePoint interface (gear wheel, ribbon tabs etc) using basic CSS. However, if I go to this page as an Administrator, I don't want anything to be hidden.

As a very basic example let's assume I just want to hide the Browse and Page tabs from the SharePoint ribbon. I can do this using the following code:

.ms-cui-tts {display:none;}

So far, so good but what if I want to prevent this modification from being applied for Administrators? To attempt this, I've modified the code as follows

As far as I understand "AddAndCustomizePages" refers to those users in the Site Members group, so the script shouldn't run for Administrators as they aren't in the Site Members group.

However, this makes absolutely no difference as Administrators still aren't able to see the Browse and Page tabs. So, either my syntax is wrong, you can't do this in the Script Editor web part or I've totally misunderstood the concept of security trimming. I'm not a developer so my understanding of the code is rudimentary. Can anyone explain in plain English why my code doesn't work and offer advice on how to achieve the result I'm looking for?

I also tried limiting the audience of the Script Editor web part to Site Members in the setting panel but this had no effect either. Stumped.

Answer 1

You can add the users to an SP Group with appropriate permissions and when the page loads, you can use JSOM to check if user is present in the group. Only if the user is present show the element else hide it.

Check If User is present in group

Answer 2

Keep in mind this is NOT SECURE! Hiding this via css is purely cosmetic. Someone with experience can easily View Source on the page and see whatever it is you're hiding, they can even un-hide it and click it or do whatever an admin can.

Read on if you're ok with that fact...

If you're an admin of the site then you have all permissions, including the "AddAndCustomizePages".

You could set the permission requirement to something higher, like ManagePermissions. However, I'm not sure you can even have asp controls in ScriptEditors like this, can you? I've never tried it to be honest...

Instead I recommend checking via javascript if the user is a site admin, and if so then "show" the portion that's hidden by default.

<script type="text/javascript">
    $(function(){
        if(_spPageContextInfo.isSiteAdmin){
            // show your element
        }
    });
</script>

I re-read your question and noticed you're specifically trying to hide ribbon tabs. If that's the only thing you need to toggle there's actually a javascript API for this. I've written a component that does this essentially like this:

 SP.SOD.executeOrDelayUntilScriptLoaded(function(){
      var pageManager = SP.Ribbon.PageManager.get_instance();
                pageManager.add_ribbonInited(function(){
                    var ribbon = pageManager.get_ribbon();
                    ribbon.removeChild('Ribbon.Read'); // each tab/group has its own ID here, inspect the page to find it
                });
 }, "sp.ribbon.js");

Answer 3

I've actually managed to do it just by using CSS which I put in a text file with an .HTML extension and saved it to my Site Assets Library. I then added a Content Editor web part to my page which references the .HTML file. Finally I assigned a Target Audience of Site Visitors to the web part. This had the desired effect of locking the interface down for site visitors while ensuring that the Administrator still has full access. One of the "quirks" of doing it like this is that the web part becomes invisible to the administrator once the page has been saved since the Administrator is not a member of the Target Audience. This is true even when in edit mode. This means that the web part can never be amended by the administrator (only deleted by going to the pages Maintenance Page). A slight irritation but possible to work around.

Thanks for replying to my mail folks.

As a general rule we have a policy of avoiding code on our SharePoint sites where possible, since we have no developers in-house. I do the best I can with a bit of CSS here and there and some minimal javascript when there is no other option. SharePoint allows me to do many things that previously would require a developer but it still has a long way to go before code-free development becomes a reality.