0

I have a document library whereby in advanced settings I have selected that users can only read, and create & edit items that were created by the user. I had made the assumption (which I now believe is wrong) that this specifically related to the read, contribute and edit permission levels, as I have modified an item's permissions and granted a specific user full control, expecting the user that created the item and this specific user with full control over just this list item to be able to see it, but the user with full control cannot. To clarify further, everyone in the department has contribute access to the list to enable them to add items.

Can somebody please confirm if this is expected behaviour?

The task I'm working on is the storing of timesheets whereby a user can only create/see their own, plus the line manager, stored in a column can also see it (I have a SharePoint 2010 workflow to grant permissions to the line manager).

If this is expected behaviour I will modify the workflow and be more explicit with the removal and granting of permissions, but the simplest approach was to use the library's advanced settings to restrict read/editing access but I thought those with Full Control would not be subject to that setting.

2
  • I'm surprised Full Control didn't work. Do they have full control to the entire library, or just to a specific item? I would try Manage List instead of Full Control.
    – Erin L
    Jul 21, 2016 at 21:04
  • It's Full Control just on the list item, all users have contribute to the entire library and then full control to specific items where they're line manager. i'm using SP 2013 (workflow in 2010 mode). I've tried with Full Control & Approve, neither worked but i'll try Manage Lists. Also, when in Library Settings -> Advanced settings and configuring item-level permissions there's a note to say users with the cancel checkout permission can see everything, but when i looked in the permission settings for Full Control this setting didn't appear at all - it wasn't there as an option. Jul 22, 2016 at 10:32

2 Answers 2

1

I did something like this, but it was just a list so it may or may not work. I gave everyone create rights to the list. When the created an item a 2010 workflow fired off. I gathered there department info and set it to a variable. It then would look to another list that had a list of departments in one field and in a corresponding field users that where managers.It grabbed the users and pulled it into the workflow. It then gave view and edit rights to the person created the item plus their managers. You might be able to pull this off by using a required field of User account for when the item is created or uploaded and use that field to grant permissions to the user and his supervisor through workflow.

2
  • Thanks @Andrew H. Eventually i plan for the line manager info to come from an external data source, for now i'm trying to prove that I can implement the permissions as required based on a line manager stored in a column. It kind of works, because permissions are granted to whoever is in the line manager column, but then the item-level permissions element within a library's advanced settings is overruling the Full Control granted to the line manager and i really didn't expect this to happen. Jul 22, 2016 at 10:37
  • I failed to mention I created custom permission levels of Edit only and create only.
    – Andrew
    Jul 22, 2016 at 13:38
0

The "Read items created by user" and "Create and edit item created by user" settings override item-level permissions. The only I've found to allow users to view items created by someone else is to grant Manage List or Full Control over the entire list.

As you suspected, you'll need to disable the custom Read Access and Create/Edit Access settings and use an impersonation step to set permissions on individual items.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.