3

I am facing this problem which i can not find a solution for inside my sharepoint farm 2013 on-premises. now i have a security group named "Users & Workers" and inside my javascript i am querying this security group, as follow:-

/_api/web/sitegroups/getbyname('User & Workers')/users/ 

but i am getting this error:-

A potentially dangerous Request.Path value was detected from the client (&).

i think the problem is related to the face that the group name contain this charecter &. so is there a way to fix this ?

here is my javascript code which is responsible to do the call:-

url = "/_api/web/sitegroups/getbyname(" + "'" + FieldValue + "')/users/";
$.ajax({
     url: url,
     method: "GET",
     async: false,
     headers: { "Accept": "application/json; odata=verbose" },
     success: function (data) {

where the FieldValue will be equal to User & Workers

here is the code from firefox F12 tools:-

GET http://t*******/_api/web/sitegroups/getbyname('Users%20&%20Workers')/users/

400 Bad Request
        110ms   
jquery-1.10.2.js (line 8720)
"NetworkError: 400 Bad Request -
  • 1
    I have same problem with asterisk(*) - replacing it with %2a doesn't help – Serhiy Jun 22 '17 at 8:54
1

You'll probably need to run the title through a url encoder so the REST API engine doesn't have a fit. Try this:

url = "/_api/web/sitegroups/getbyname(" + "'" + encodeURI(FieldValue) + "')/users/";

or you can do it to the entire URI.

| improve this answer | |
  • 1
    but still i got the same exception ,, and inside my firefox F12 the url will be as follow Users%20&%20Workers.. so why the & is not being encoded ? – john Gu Jun 2 '17 at 0:59
  • 1
    try encodeURIComponent(FieldValue) – Mike Jun 2 '17 at 1:06
  • 1
    now using encodeURIComponent(FieldValue) the value will be as follow Users%20%26%20Workers so the & got encoded as %26 which is compatible with what is mentioned here prasannaadavi.com/2014/06/… but still i will be getting the same error.... looks to me like a bug in sharepoint rest api.. what do u think ? – john Gu Jun 2 '17 at 1:23
  • 1
    I think there is no bug in the request. I am able to get my group and users which has been tested on SharePoint online site. https://xyz.sharepoint.com/_api/web/sitegroups/getByName('Owners%20%26%20Members')/users – Venkat Konjeti Jun 2 '17 at 1:51
  • @VenkatKonjeti i am using sharepoint 2013 on-premise . and seems as mentoned on this link also sharepoint.stackexchange.com/questions/164673/… that users can not get this working on on-premises!! while on SP online seems it is working well.. – john Gu Jun 2 '17 at 2:04
1

There is an issue with & SharePoint on premises some rest api call. I have tested your scenario and I could achieve with different query

var groupName = encodeURIComponent(groupName);
_spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups?$filter=Title eq '" + groupName + "'"

or

var groupName = encodeURIComponent(groupName);
_spPageContextInfo.webAbsoluteUrl + "/_api/web/sitegroups?$filter=LoginName eq '" + groupName + "'"

My example is as follows

//my groups is "Owners & Members"
http://sp-2013ent:1111/_api/web/sitegroups?$filter=LoginName eq 'Owners%20%26%20Members'

This is 100% working on 2013/2016 on-premises servers

Get Id from above call and use for your next calls to get users. Example as below

http://sp-2013ent:1111/_api/web/sitegroups/GetById(8)/Users

I know this requires additional call but solves your problem

| improve this answer | |
  • thanks for your answer, will try this .. but i can not understand why you are doing substringof inside the filter ? one time you used LoginName the other you used Title .. – john Gu Jun 2 '17 at 9:17
  • second question also when i do the following call "/_api/web/sitegroups inside my RESTClient tool, the security group will have the following values <d:LoginName>Users &amp; Workers</d:LoginName> <d:Title>Users &amp; Workers</d:Title> so i am not sure why the Title and LoginName will have amp; inside them... – john Gu Jun 2 '17 at 9:23
  • I got failed when I put Title eq 'Owners %26 Members' but you can try that first it works you can use that. The LoginName and Title work same I have give LoginName just to match your call getByName rest call. The & is an XML compliant character so it will always be converted to &amp; – Venkat Konjeti Jun 2 '17 at 13:00
  • 1
    I have tested query again with eq filter surprisingly it is working. I might have typo in query yesterday. So now you replace filter condition as $filter=Title eq 'Owners %26 Members'. It solves your problem. I am changing my answer also. – Venkat Konjeti Jun 2 '17 at 13:19
  • 1
    Strangely the filter operation eq works case insensitive but when it comes to sitegroups it is working on case-sensitive. This might be an issue with REST API. In this case, you can force a user to type exact match string or need to find a way to give a dropdown with a list of groups prepopulated. – Venkat Konjeti Jun 6 '17 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.