How can I hide allitems.aspx from curious people?

Question

I have a custom ASPX page in WSS 3.0 which I use to capture email addresses. These emails are stored in a list called Notificiations using nothing but jQuery and SPServices. Because I'm using jQuery and SPServices, I can't use elevated privileges so everybody has to have read/write/delete access to this list.

So I'm trying to figure out what the best method is to prevent somebody from getting to the AllItems.aspx page for this list to seeing the content. I don't see anything stopping a clever user from going to http://somesite/.../Lists/Notifications to see what's there. I've tried to insert some jQuery to hide the webpart but that doesn't stop the email addreses from being seen if "View Source" is selected for the page.

I can check permissions on the page for the current user. If they don't have full permissions, should I redirect them somewhere else? The administrators should still be able to see the data and edit as usual.

Any tips/ideas here is really appreciated.

Thank you very much, dave

Answer 1

Down the path of your jQuery route, instead of hiding the web part, you could have your jQuery simply remove all content of the web part div. So if you are trying something like $('#webpartDiv').hide();, you could instead remove the html contents $('#webPartDiv').html("");

Another alternative is to set an authorization rule in your web config deny access to any pages within the Notifications directory

<location path="/Notifications">
    <system.web>
        <authorization>
            <deny users=*" />
        </authorization>
    </system.web>
</location>

Answer 2

Follow these steps:

1. Create another view and change the default view to this view
2. Set permissions for the list from List Settings as 'Limited Contribute - default view' for all users except admin.

Edit: 3. Go to Site settings -> Permissions -> Permission levels and create a permission for only viewing the default view.

If this does not help:

1. Open the list and create 2 views. 1 for normal user which should be the default one.

2. The other view is for admin and it should be with a different name and give all columns and conditions as of the view 'All Items' [Give a name for the view that users cannot guess]

3. Delete the view 'All Items' [This is to avoid users from getting the view when they type 'All items.aspx']

4. Open the list in the 1st view which is default for all other users.

5. Type 'pageview=shared&toolpaneview=2' at the end of the url and modify the web part.

6. Remove the Full toolbar view from the view options and this will disallow any user from changing their views.

7. Give your admin the link to the second view directly.

Hope this helps :)

Answer 3

Change the filter options for AllItems.aspx such that it returns nothing, that should do it for you.

Nobody should be able to modify or create new views of the list, so this might be enough for you.

Answer 4

You may edit (or add one and edit) the Role definition associated with your group :

if you remove the "View Application Pages", it will prevent these actions :"View forms, views, and application pages. Enumerate lists".

So the users won't be able to view the content of the lists.

Answer 5

You can configure the list view webpart that is embedded in the page to display content with admin rights only.