2

Let me explain my SharePoint2010 environment, my solution is sandboxed solution and my site is public facing site. This site is hosted outside my premises and we are not allowed to use any server side code deployment over there. I figured out following solution.

  • Http Module redirection
  • Use an elevated privilege option and Lock down the anonymous access ( but hosting environment is not allowing any server side code other than sandbox )
  • IIS URL redirection ( I think this is the best solution to stop anonymous access to view the lists pages)

Please advise for my scenario, IIS URL redirection is enough to stop the anonymous access to site's list pages or I should adopt other solution. Reason Actually I have to add suggestions in the suggestion list, for this I need an anonymous access to the list, That is the bone of contention. we need to provide this functionality ,but we don't want anonymous user to access the viewlsts.aspx pages Hope I elaborate my issue clearly!

Improve this question
1
  • With List Pages you mean EditForm, NewForm, DispForm ? That means you're effectively denying list access to anonymous users (they could still see values from lookup fields to the list). You could create a list permission denying anonmous users access to list pages (there's a specific permission level for it).
    – Cameron Verhelst
    Commented Jul 15, 2014 at 8:41

2 Answers 2

Reset to default
1

From SharePoint 2007 there's a specific OOB feature designed for this purpose called ViewFormPagesLockDown

http://sureshpydi.blogspot.nl/2013/12/viewformpageslockdown-feature-in.html

Improve this answer
3
  • Actually I have to add complains in the complains list, for this I need an anonymous access to the list, That is the bone of contention. we need to add to the list and we don't want anonymous user to see viewlsts.aspx pages
    – Nazish Ali Rizvi
    Commented Jul 15, 2014 at 10:03
  • lock down feature will disable anonymous user to add suggestion into the suggestion list as well.
    – Nazish Ali Rizvi
    Commented Jul 15, 2014 at 10:11
  • 1
    feature will prevent the user to access page NewForm.aspx and so the user can't access the standard UI page to add a new item. Permissions are controlled in a different way: if permission to add items is given to anonymous users, then is possible to let anonymous add new items to 'Complains' list by building a specific control for that purpose
    – Massimo Prota
    Commented Jul 15, 2014 at 10:34
1

Another solution, and one I've leveraged on numerous projects, is to use an SPSecurityTrimmedControl within the masterpage to wrap the entire contents of the root <form> element for the default masterpage (because Application Pages like /_layouts/viewlsts.aspx inherit the default masterpage of the local site). Here's an example:

<body scroll="no" onload="if (typeof(_spBodyOnLoadWrapper) != 'undefined’) _spBodyOnLoadWrapper();">
  <form runat="server" onsubmit="if (typeof(_spFormOnSubmitWrapper) != 'undefined’) {return _spFormOnSubmitWrapper();} else {return true;}">
    <Sharepoint:SPSecurityTrimmedControl runat="server" ID="HidePage" Permissions="ManageWeb" PermissionMode="All" PermissionContext="CurrentSite">
      <div id="FullPage">
        <asp:ScriptManager id="ScriptManager" runat="server" EnablePageMethods="false" EnablePartialRendering="true" EnableScriptGlobalization="false" EnableScriptLocalization="true" />

        ... (The rest of the page)

      </div>
    </Sharepoint:SPSecurityTrimmedControl>
  </form>
</body>

As such, any content within the pages attached to this masterpage will be hidden to users that lack "ManageWeb" permissions. You can even get creative and add markup with a "Nothing to see here.." message that only appears to user without sufficient permissions, perhaps with a link back to where they should go.

You can read more about the SPSecurityTrimmedControl here: http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.webcontrols.spsecuritytrimmedcontrol_properties.aspx

The three properties you will want to focus on are the "Permissions", "PermissionMode" and "PermissionContext" as seen in the examples above; for reference, the examples here would hide the contents of any page using this masterpage to all users except those with Owner (or equivalent) rights on the current site.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.