0

I am working on a sharepoint enterprise server 2013 sites mainly of type Team Sites. some of them have the publishing infrastructure enabled and the other do not have these features enabled. and inside the sites i granted some users Contribute Permission to allow them to add/edit/delete list items. but seems the Contributor users will be granted UN-expected permission which i was expecting. For example if a contributor user go to the team site home page (which we have added many web parts and customization inside it) such as http://servername/sites/hr/home.aspx then they can edit this page, add extra web parts, remove others web parts, etc...

so can anyone advice what is the best appraoch to prevent Contributor users from modifying the site pages while allow them to add/edit/delete list items?

now i read about this and i found 2 simiar links:-

Deny "Edit Page" permissions to Contributors on a publishing site?

Prevent Users from Editing Pages while maintaining Inheritance

and both of these links suggest to beak the inheritance of the site pages library and only allow admin users to edit the pages library, while allow other users to Read. while this will technically work (although i did not test it). but i think it will have the following drawbacks , so i am not sure if there is another appraoch which will prevent these drawbacks from happening :-

  1. Breaking the permission on lists' levels is always a bad appraoch from performance perspective, as it will create performance overhead.

  2. breaking the permission on the Pages library, will not scale well. for example if i do this to the root site, and i create a new sub-site, then i need to do the same process of breaking the inheritance on the Pages Library at the sub-site level also ...

so can anyone advice on this please?

Thanks

2

Usually when I run into an issue like this I put those users into the visitors group and then create a separate group like "list contributors" and then edit the list permissions and grant the "list contributors" group contribute permissions to that list.

  • so you work the other way ,, you add all users to the Visitors group. and then break the permission on the new lists (such as tracking lists, document libraries, etc.. ) , and grant Visitors a contribute permission on these lists ?? – john Gu Feb 7 '17 at 16:16
  • 1
    John that's exactly what I do, I take more of the limited access approach so I don't accidentally give people more access than they need. – David Hartman Feb 7 '17 at 16:48
  • 1
    thanks for the reply.. but in my case all contributor users should have contribute permission on the lists (i have now 5 lists) .. and i only want to limit their access to the Pages library.. so maybe in my case it will be easier to stop permission inheritance at the Pages library rather than having to do so on the 5++ lists.. what do you think ? – john Gu Feb 7 '17 at 17:55
  • that works as well, just as long as their contribute rights to the site do not give them more permissions than they need. – David Hartman Feb 7 '17 at 19:54
0

More simpler way is to create a custom permission level.

Got to sitecollection permissions→Permission levels → Add permission levels→ Here you can add what kind of permissions you want and then save it with a name.

Note: In custom permission add → add items, delete items, view items, approve items, view versions, create alerts, manage lists, view pages. that's it, please don't add manage permissions or else manage web sites permission under it.

Go to your group and edit permissions and then instead of original contributor access provide this custom permission.

You can use this same custom permission to different groups too

  • but there is not any permission level which will allow me to give contributor users ability to manage lists items without managing site pages... is there any ? – john Gu Feb 7 '17 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.