I have a workflow that sends emails out. When a user receives the email, there is a hyperlink called Review. When user clicks on Review, the value of the column called ReviewStatus on the Improvement List will be changed to Requested. I have a script below that handles this on a Content Editor Web Part:

<script language="javascript" type="text/javascript"> 
        var listItem;
        var list;
        var clientContext;
        var siteUrl = "https://contoso.com/process/";
        function getSetListItem() {
            this.clientContext = new SP.ClientContext(siteUrl);
            if (this.clientContext != undefined && clientContext != null) {
                var webSite = clientContext.get_web();
                var itemID = parseInt(GetUrlKeyValue('ID'));
                this.list = webSite.get_lists().getByTitle("Improvement");
                this.listItem = list.getItemById(itemID);
                this.clientContext.executeQueryAsync(Function.createDelegate(this, this.OnLoadSuccess),
Function.createDelegate(this, this.OnLoadFailed));
        function OnLoadSuccess(sender, args) {
            var value = this.listItem.get_item("ReviewStatus");
            this.listItem.set_item("ReviewStatus", "Requested");
            this.clientContext.executeQueryAsync(Function.createDelegate(this, this.OnLoadSuccess1),
Function.createDelegate(this, this.OnLoadFailed));
        function OnLoadSuccess1(sender, args) {
        function OnLoadFailed(sender, args) {
            alert('Request failed. ' + args.get_message() + '\n' + args.get_stackTrace());

The above works for me but I have Site Col Admin permissions. When a user with Read permissions clicks on the hyperlink it takes them to the page where the CEWP is and they get the below message:

enter image description here

I know it's permissions but what can I do to make it work for users who doesn't have the permissions? By the way, the client wants to keep the permissions to Read Only for users so there's nothing I can do about that.

Any help is appreciated.

2 Answers 2


Client-side, the only idea I have is to create an independent list, using the javascript to add an item to that list containing the ID of the original item. Then run a workflow on the new list that uses an impersonation step to set the ReviewStatus field in the item with matching ID.

  • I'm sorry I think I understand but wanted clarification. By doing your method it would only update the new list and not the original list where I want it to happen right?
    – Nina G
    Jun 2, 2016 at 18:08
  • After an item is added the new list, a workflow would start on it. This workflow would use an impersonation step to change the item in the original list. (Update List action)
    – Erin L
    Jun 2, 2016 at 18:12

You are updating the list item with read permission using below code which is definitely not going to work.

this.listItem.set_item("ReviewStatus", "Requested");

You can not update a listitem without having permissions on it. Running with Elevated privileges is the solution for your problem (Server). Apart from that i don't think there is a solution for it, because it would be a security issue in SharePoint.

Otherwise you can check other impersonation methods for this.

How to Programmatically Impersonate Users in SharePoint

Impersonation in SharePoint 2010

  • Is my information useful for you?
    – Hardik
    Jun 7, 2016 at 11:40
  • Did you find this above information useful for you?
    – Hardik
    Jun 17, 2016 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.