2

I have a team site collection inside my SharePoint 2013. Now some users have restricted read permission inside this site collection. Now from my previous experience with permission I realize that users with restricted read will not be able to view lists items, because viewing list items require “View Application Pages” permission which is not included by default inside the restricted read. But now inside my site I have these components:-

  1. Document library
  2. Issue tracking list, with 4 list view links. Where one of the list views I have modify its CAML query using SharePoint designer (named view 4).

Now when users with read permission access the site home page , then can view everything ; document library, 4 links for the list views as follow:-

enter image description here

While when restricted read user access the site home page they can view the following only; document library + a single list view link , where this list view I have modified its CAML query using SharePoint designer (unlike the others list views which I only modified using the UI):-

enter image description here

The confusing thing is that if the restricted read users click on the View 4 link they will get the following error:-

Let us know why you need access to this site.

So can anyone advice on these 2 points:-

  • why restricted read users are able to view the document library items, while they cannot view Issue tracking list items ?
  • why restricted read users are able to view the “view 4” list view link ONLY, while they will not be able to see the other list view links? is this because I have modify this list view using SharePoint designer ??
Improve this question
4
  • "Restricted read" users can view pages and documents, but cannot view historical versions or user permissions (from MSDN.) And the results are passing through the CAML at first so it's not security-trimmed. – YogaPanda Oct 17 '16 at 20:38
  • @YogaPanda i did not get your point,, now all views contain CAML queries ,, but the list view link which was shown to the restricted read users is for a list which i modify its CAML using sharepoint designer... – john Gu Oct 17 '16 at 23:25
  • @johnG - how are you fetching the 4 links used to navigate to list view? which webpart have you used for that ? – Gautam Sheth Oct 18 '16 at 16:12
  • @GautamSheth i did not use any web part, i used the "edit links " link which is used to modify the left hand side links – john Gu Oct 25 '16 at 1:38
1

The Restricted Read Permission Level in SharePoint 2013 are authorized to

View pages and documents. For publishing sites only.

This means that the users with restricted read permission only, are not authorized to view lists and their items. That's SharePoint default setting.

As per your View 4, it's hard to tell. Either a user have more permissions than restricted read permission which you can verify with list settings > permissions for this list > check permissions.

Another option is that you unintentionally edited the permissions for the View 4. It is possible to do, but it's quite unlikely. To overcome this, make another View, and see the outcome.

Reference:

Improve this answer
6
  • thanks. so when you say restrict read can not view lists and items,, then this exclude docuemnt libraries ? as documents libraries are also lists ,, is this correct ? because in my case restricted read users can view the documents but can not view issue tracking items. second point i am not sure if it is possible to set a unique permission for a list view .. as all the views 1,2,3,4 are referencing the same list ,,and user have restricted read on the list. but for a reason or another he can view "View4" link although if he click on it he will get an error, that he can not view it items. – john Gu Oct 20 '16 at 12:57
  • 1
    @johnG No - Libraries are not Lists. Restricted Read users can see Libraries, but not Lists. – Benny Skogberg♦ Oct 20 '16 at 13:04
  • ok then i am still not sure why restricted read was able to see the "View4" list link. where this list link I have modified using sharepoint designer to update its CAML query. – john Gu Oct 20 '16 at 15:11
  • In my case, restricted read users cannot view either the list nor the libraries in the site where they only have restricted read permission. And when they access the site by clicking the navigation or type out the URL, they will get a js alert:"request failed access denied. You do not have permission to perform this action or access this resource" When they click ok, they will be remained at the current site, able to see site title and site logo but not site description. – YogaPanda Oct 20 '16 at 20:26
  • I wonder if someone accidentally share the 4th list or site to the user who only has restricted read permission. – YogaPanda Oct 20 '16 at 20:28
1

Regarding your first question my answer is same as above which is a restricted read user can only view pages and documents and not list items. Since Issue tracking is a list they are not able to see the items.
About the 4th view it is connected to your coding. Of course you know that each view is a page. When you make a view as a ** normal list view** there is no problem in permission and it works as a list view which a restricted read user is not allowed to see the items, But When you make it with CAML query you just made a Published page so the rules change.
My suggestion is to make a 4th view in list and add your require functionality with a Script editor in the view it self and don't change the coding in SPD.

Improve this answer
2
  • 1
    interesting point that modifying the list view using SPD , will make the page as Published Page ,, and restricted read users will be able to see it.. now regarding your suggestions of using "Script Editor" how i can use script editor to modify the view CAML query?? – john Gu Oct 24 '16 at 17:21
  • you can write your query, save it in Assets Library and refer it in "Content Editor" in your required view. – Shaghayegh Nov 2 '16 at 22:20
0

I wanted to answer this older question as I just started using Restricted Read for the first time. To say that Restricted Read cannot access list items is not actually 100% accurate. Restricted Read will not be able to access DispForm.aspx nor EditForm.aspx so for 99% of the cases this means users can't get to list items.

If, however, you use REST such as /_api/web/lists/getlistbytitle('list name')/items(listItemID) you can actually pull the column data and users with Restricted Read will be able to see the results of the REST or AJAX call but still won't be able to edit the item directly through the OOB forms.

This would also explain why navigating directly to View 4 would throw an access denied message, yet pulling in the data through a dynamic query would be able to access the information.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.