2

Due to security issue in my SP 2013 DMS portal, I need to hide Upload files using Windows Explorer instead when Uploading document in a Document Library. Is this possible?The issue is that we have created folders like Confidential and Public.So,if a user uploads a document can view this folder structure in the document library and delete/rename the folders and temper the files and folders. This is a security hole and it needs to resolved.

Improve this question
7
  • Are you looking for only css solution?
    – Asad Refai
    Jun 11, 2015 at 10:03
  • Anything is fine for me.We need to resole this as customer raised this as a security issue in my SP 2013 portal
    – samolpp2
    Jun 11, 2015 at 10:10
  • Then I guess setting permissions to a folder is the best and recommended option.
    – Asad Refai
    Jun 11, 2015 at 10:11
  • I have a console application which does this setting permissions job.I have 40+ site collections & each site collections have a mini.70+ subsites with 10 doc libs.
    – samolpp2
    Jun 11, 2015 at 10:13
  • Excellent, if you have not already a code to check for confidential folder in document libraries, then a function with few actions like to identify confidential folder in doc libs, breakroleinheritance and assign permissions to group will do the job.
    – Asad Refai
    Jun 11, 2015 at 10:18

2 Answers 2

Reset to default
2

Hiding Upload files using Windows Explorer instead is not the best practice. SharePoint takes care of view permission OOB provided we set it correctly.

SharePoint do not show any item or document to a user who does not have permission to view.

Coming to your case, where in document library you have 2 folders confidential and public. We can set item level permissions on confidential folder which will restrict users from a particular group to view.

Assuming you are on SharePoint 2013, you can follow below steps to set unique permissions on folder. After this user will not be able to see the folder on UI as well as in windows explorer.

1. Go to the document library and select the folder and click on shared with option. Refer below screen shot.

enter image description here

2. A pop up will open, then click on Advanced link.

enter image description here

3. You will now navigate to permission settings page, where its noticed that folder is inheriting parent's permission. We need to stop inheriting and set unique permission to a group. Which will ultimately restrict users from that group to view the folder in UI as well as in windows explorer.

enter image description here

Improve this answer
1

Hiding does not resolve a security issue. He can still enter the webdav URL into an Explorer window by itself.

However, if he is able to view and alter the Folders in the Explorer-mode, he does have rights to do so, so he can do the same Thing in many other ways (via the UI or the Client-Object model through Javascript or C#-API)

if that is a security hole, you have to rethink your Architecture and permission structure.

Improve this answer
9
  • Thanks for the update.Can you help how to hide this link?Any CSS trick or any Powershell way.
    – samolpp2
    Jun 11, 2015 at 9:39
  • 1
    You could replace the uploadpage with your own.
    – Leopold Lerch
    Jun 11, 2015 at 12:25
  • 1
    you can set your own page using web.CustomUploadPage = "/" + SPUtility.ContextLayoutsFolder + "<path to your applicationpage>"; web.update().
    – Leopold Lerch
    Jun 11, 2015 at 13:35
  • 1
    this has to be done on per web basis
    – Leopold Lerch
    Jun 11, 2015 at 13:36
  • 1
    in my specific case I Extended the existing upload-page, if you do one completely on your own, you will have to take care on to which documentLibrary the user wants to upload the file. However, I guess you will be able to get that Information using the SPContext.Current.List or SPContext.Current.ListID properties
    – Leopold Lerch
    Jun 11, 2015 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.