Prevent user from viewing list but allowed to add through custom webpart

Question

What is the best solution for such requirements?

• Allow users to add items to list from custom webpart
• Prevent same grp of users to view/edit items directly from list
• I cannot use elevated privilege to add items from webpart as when a new item is added i will need to trigger workflows.

We are preventing users from editing the list directly as they are only allowed to enter data through a custom webpart. This is to secure integrity of data. These data once submitted should not be touched. This data will be run through a list of workflows for approval.

Thanks in advanced!

Answer 1

1. Allow users to add items to list from custom web part - On default new form put a script to navigate to page which says - "New item cannot be added from here" or alternately add content editor on new page with text " New item cannot be added from here" and hide (not delete) the existing web part on page

   2. Prevent same group of users to view/edit items directly from list - For edit follow above process. For view either create default view with specified columns

   3. I cannot use elevated privilege to add items from web part as when a new item is added i will need to trigger workflows. - The issue you have with using RWEP is that created and modified will be set as 'System Account", the solution to that is update "Created" and "Modified" as current user. Take current user before starting of RWEP. This way workflow should trigger as current user not system account.

Answer 2

Remove the NewForm and EditForm from the list. This way nobody can create or edit list items.

Answer 3

Here's the deal.

• You can create a default view with access to only a specific user group. There are ways to implement this.
• Also, from all views, remove link for new item and remove column with context menu. Additionally you can put some javascript to not allow advance ribbon except admin group or something.
• Alternatively. You can put some javascript to validate if user is not part of your XYZ admin. If he is admin, let me open the default form/list/views, else redirect to your custom webpart page.
• Removing default form would create mess in case if some changes are expected from backend (direct to list).

Another best approach would be Let the default form be there. Just open those in edit mode. Open webpart properties of default webpart. Set target audience to a specific group.. lets say admin group. Now below that add your custom webpart with no audience target. this will lead the user to your custom webpart even if he clicks default links.

Answer 4

Thanks guys for your ideas.

In the end, I decided to go with the following approach:

• Remove all permissions from any user for the specific list.
• Create another user account for impersonation purposes.
• Give this new user contribute rights to the specific list.
• Web part will impersonate this user account during submit. This will ensure that the workflows can get triggered as this is not a 'System Account'.
• Publishing workflows using this newly created user account. Workflows are also added an impersonation step which will add 'Read' rights to the current item in list. This is required as this will give user access to the workflow task.

This approach ensures that user will not have edit/delete rights (the 'New Item', 'Edit Item', 'Delete Item' buttons on the ribbon are disabled automatically due to no permissions) to the list hence securing the list data integrity. User will only be able to submit their data through the webpart.

Feel free to share your opinions on this solution. Thanks.