0

Not finding any real answer to this question, so not sure if I am articulating my question correctly...

SCENARIO:
I am creating an college registration form for students using a SharePoint-hosted Add-in. Requirements make it thus and MUST be all self contained rather than split up (cross-domain). Therefore, lists and libraries are created by the add-in when deployed. Students are able to register and add documents just fine.

The problem I am seeing is that if a student happens to know the direct URL to the list or library, instead of using the GUI design, he/she would then be able to view/edit all the other student records and personal information.

Aside from naming the lists crazy names, is there anything I can do? Worried that some one might read through a JavaScript file, and figure out locations. I want to force the user to ONLY use the GUI (ASPX page) and not see the SharePoint side of things.

CAVEAT: There might be certain people who will need to access these lists directly to "Open with Explorer".

Improve this question
9
  • For the custom list can't you set 'Read items that were created by the user' in the advance setting for custom list?
    – SharePointer
    Commented Apr 9, 2017 at 21:25
  • Once you run the installed app and go to the list directly, there are no Advanced Settings options that I can recall.
    – Keltanis
    Commented Apr 9, 2017 at 23:21
  • Also, the issue would still be allowing others to see everything.
    – Keltanis
    Commented Apr 9, 2017 at 23:36
  • Have a look at this: ramontorras.net/2015/05/07/… and sharepoint.stackexchange.com/questions/97011/…. It seems that you can set the 'Security Bits' to 2. Allowing others to see everything shouldn't be a problem as you can always assign owner/higher permissions to enable them to see everything in the list.
    – SharePointer
    Commented Apr 10, 2017 at 19:48
  • So it sounds like I can, depending on a user' role, set the security bits on the fly when they visit that page? If multiple people are accessing at once, does this affect the others or does it work in their own little instance?
    – Keltanis
    Commented Apr 10, 2017 at 20:00

1 Answer 1

Reset to default
0

The best way I have found is though security bits and to remove the allitems view from the list.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.