1

I had a test scenario where

User Betty didn’t have permissions to a destination library (only I had permissions to it) Via the Content Organizer rule and the Drop Off library, Betty could send a document to a library where she didn’t have access. Anyone addressing this issue and how? We just don't want people to be able to send things to a destination where they don't have access, but looks like the Content Organizer Rules impersonate some part of the move.

What's odd is you can see the "CreatedBy" as Betty, but she can't go to the library and even see the moved document...permission is denied.

Looks like this is a known issue on 2010 (as shown via 2 links below), but hoping we can address in 2013 and somehow disallow users from sending things to destinations where they don't have access:

Content Organizer Rules overrides Folder level Permission

Content Organizer Permissions

1

Agreed that this is by design. The Content Organizer is built upon the functionality from the Records Center in SharePoint 2010.

The Record Center allowed users to send documents to another library/site that could then be managed by the Records Management Team. By design the user should not have permissions to this destination library. You would of course want to see the Created By in this scenario so that a records manager could follow up with the user in case it was missing a metadata property or the retention rules were unclear.

The Content Organizer users this same functionality. This isn't really a security risk in my view though because an administrator must first configure a global Send To location in order for it to be used within a Content Organizer so it's not as if a end user can by-pass the permissions model themselves. This is a deliberate configuration.

0

I think the answer here is to not use the content organizer. AFAIK, this is functioning like it should, if it worked that way in 2010 and 2013 too.

I think the only way around it would be to create an event receiver to see if the user who edited the document properties has permission to the destination location and handle it how you want.

I can see the use case as a central place for people to upload documents to and not having to worry about giving people access to places they don't need to go to other than to upload a file. Like I don't really want/need access to some HR site, but if I have a form I need to send them, I shoot it to them via the content organizer and it gets delivered to their library.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.