User can edit SharePoint Site-Page without permission for it

Question

I have a problem in my SharePoint-environment where I created a custom permission-level to give permission for list-editing, but not for site-page-editing. This ist how the permission level looks like:

I added this permission level to the group "visitors of [our site]", each user except externals is member of this group.

Then I tested if it works as expected, unfortunatelly it doesn't. We had a very strange experience when trying to edit a SharePoint-SitePage.

1. The user still has the button "edit" to click on:

2. After the user clicks on "edit" it gets an error-message "[..] an unexpected error occured [..]":

3. But the error message can be clicked away, the site-page is editable, e.g. a "!" can be added and a button "Save draft" is visible:

4. The draft can be saved with the added "!", but there is no button to publish (at the moment):

5. But when you reload the webpage (F5), the "publish" button magically appears:

6. The user clicks on it an the site-page is published whith the added question mark: Other user can also see the changes on the site-page.

It is still possible to edit site-pages following this process, 24 hours after the permission was set as seen above. So it is quite unlikely that the problem hast to do with some long running permission-change cron-jobs on Microsoft side.

The testuser has no other permissions on the site.

I would appreciate any help on what I've done wrong in permission setting. Thanks a lot!

Answer 1

There is no isolated permission to control who can edit Site Pages. You will need to remove the “Edit Items” permission from the custom permission level. That is what it takes to edit Site Pages.

If you want to keep the ability to edit list items, set unique permission on the Site Page Library via Library settings > Permissions for this document library.