Field level permission development

Question

I am aware that there already are some questions regarding on how to implement field level permissions customization in SharePoint, such as:

• SP 2010: column permission
• Permissions for List or Library Columns

Most of their answers either say that it's impossible, either provide a user interface or dependent list configuration. Recently, I've read the following article: 3 Approaches to Restricting Access to SharePoint Columns and Metadata. The author wrote there:

The third option is to write custom code that enforces custom business logic for data access.

There are third-party solutions out there that address column-level security scenarios. Most (or all) of them use one of these approaches: conditional formatting, custom content controls or forms, related lists, or “middle man” injection into the content access processes of SharePoint.

I am aware that third-party SharePoint add-on providers, such as KWizCom, offer solutions which allow such field level permissions customization. Once hidden, a SP list field cannot be retrieved even if the user tries to use the web services API, MS Access or some other data access technique.

Since such goal is clearly possible, but MS doesn't provide any documentation on how to do it, could you provide some resources/hints about how to develop and implement such a customization?

Answer 1

There is projects like SharePoint Permission Extension (http://sppex.codeplex.com) on codeplex. if you take a look at code they override CreateChildControls method of EditControlListFieldIterator which cause control of SharePoint field rendering. Take a look at this class for example.

SharePoint Permission Extension has an application page for field permission settings. basically after you install solution whenever you open a item display form or item new/edit form, it checks all settings to see if there is permission rule for current list and all fields and if current user match the rule, code allows the field render.

Answer 2

When we writ the rule for hiding the field through Kwizcom, it actually creates a tag with style : hidden. If you check the HTML code for the page you can see that value with style as hidden. So using jquery / javascript it is easy to retrieve the value.

Let know if i can help on this further as i have actually retrieved the value using jquery when kwizcom fields were hidden using rule.

Answer 3

SharePoint doesn't provide a facility for securing individual columns, I mean OOTB. The lowest level SharePoint operates at is security on a whole list item.

We can modify the NewForm.aspx or EditForm.aspx or DispForm.aspx to restrict certain columns to be read only or hide by checking permissions with the help of ECMA script and JQuery.
Another possible workaround is to write an event receiver on the ItemUpdating event that checks security before saving changes.