Implementing security on library and view

Question

Does anyone know if it's possible?

I have a library for which i have 2 views.

1. The first view is the actual library view that uses an infopath form. Once people fill the form it is saved in the library.
2. The second view is a calendar view so people can use to display the events.

My problem is that i have a group name "Marketing". I want that group to be able to fill the form. But from the calendar View i want that same group to be able to modify only the own events.

i tried this action formula on the form load:

Any occurrence of name Is not equal to "Marketing"

And

Field Applicant is not equal to "Marketing"

Change view to ReadOnly

But the problem i have now . People from the Marketing group only have access to the form. They can't fill the form.

Answer 1

If you're using a library, and not a list, you can't change the create + edit behavior to allow users to only edit their own entries. The question becomes whether this is a security need, or simply the desired user behavior. If you're just trying to avoid people updating other items, you can filter your view with [Me] so that users only see their items in the view. This doesn't prohibit them, however, from accessing other items directly (via url, another view, search, etc.). This technique is security through obscurity. It's not recommended, however, if you really can't afford to have someone access something they absolutely cannot see or edit. With version history, however, you'll always have a snapshot of who made what updates. Outside of this, you're looking at item-level permissions, which I would try to avoid if it all possible. Normally the security need is more closely related to who can read data, as that's where you're potentially exposing information to parties that shouldn't have it.

Cheers, Matt

Answer 2

If the user is not "Marketing" or not satisfies any your conditions, disable the controls. (If you switch the form views, they can switch back by themselves.)

For example: There is a Event Date field, add a Formatting rule, Condition is userIsGroupMemberOfMarketing is false and CreatedByfieldIsGroupMemberOfMarketing is true, then Disable this control. (If you do not know how to check membership, here is a reference: https://social.msdn.microsoft.com/Forums/sharepoint/en-US/b36ba3d2-efd7-4f73-8f57-8aa81382dadf/how-to-check-if-a-user-is-a-member-in-a-sharepoint-group-within-web-infopath-2013?forum=sharepointcustomization)