I am very familiar with the issues of Item Level Permissions (ILP). However we are having an internal discussion of the combination Views, and ILP.

For simplicity sake, there are two views each applies a filter. There are very limited number of items in the Approvedview.

Approved Obsolete

The list has unique permissions, and I'm confident that this forces each item to have ILP, even if the item is the same as the parent. SharePoint still has to run the check. Is this correct?

The overall question is. If users only will ever access The list in the Approved view... Is the problem with ILP mitigated? They can see that there is an Obsolete view, but would be told to never clicked on it, using search would still circumvent this.

Or! For security reasons, is permissions/authorization checked first?

  • Item Level Security IS Item Level Security, users will only see items they have access to. If they do not have access they won't see them in View or in Search. The View itself will never appear in Search (unless you put the ListView WebPart on a page with other content) – Danny '365CSI' Engelman Dec 4 '15 at 21:53
  • So what I'm asking. If someone clicks on the List and the default view is "Approved", will SharePoint search every item in the list via security, and then return only approved. Or will the SharePoint server be hit to get all approved items, and then security checks are ran? – christopher clark Dec 4 '15 at 22:02
  • I am going to venture a guess that SP will check security before pulling the items from the content database, versus pulling all items and then removing the ones not within the user's security context. – steveareeno Dec 5 '15 at 3:28
  • All other sources are saying security is checked first as well. Nothing on msdn or Microsoft though. – christopher clark Dec 5 '15 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.