Create security field

Question

How can I implement security field for SharePoint list?

For example, the list should have field that contains salary. This field should be displayed for the Managers, but should not be displayed for the Employees. The minimum element that supports security trimming is a list item. If I want to use security trimming on the field I should create look up field in one list and set correct permissions to another (related list). But in this case the user have to select predefined values. It is not a good solution for a salary field.

Do you have any ideas?

Answer 1

There are some third party solitions, for example SPListDisplaySetting from CodePlex (not sure it will work for SP2010 though).

Another approach is to implement custom field type. You can find a detailed description here on InfoQ:

• http://www.infoq.com/articles/Dressel-Gogolowicz-wss-security

Also, you can try to customize list view, as described in Stefan Stanev's blog:

• http://stefan-stanev-sharepoint-blog.blogspot.com/2010/11/xsltlistviewwebpart-how-to-display.html

But actually, all these approaches are usually not enough secure. You can find they're acceptable for you, but be aware: usually the "secured" data could be easily revealed through:

• Data View (access-like ActiveX control)
• Document Information Panel (properties are shown for documents in Word)
• Custom list views or DataView webparts with custom datasources
• Direct request to ListService.svc or Lists.asmx web services
• SharePoint Search

So, the lookup-column approach seems to be a very good idea, because it uses OOTB security.

And this idea is appliable for salary field too, but you will need to write some extra code of course :)

1. Add extra column of type Single line of text to your list, name it "Salary" with description "New salary value".
2. Create lookup column "CurrentSalary" and point it to the Salaries list.
3. Hide "CurrentSalary" from list forms
4. Hide "Salary" from list views
5. Add event receiver ItemAdding, and add code which do the following:
   • Grab salary value from Salary field to some temp variable
   • Clear the value from Salary field (!)
   • Create a list item in Salaries list, and fill it with the salary value
   • Apply appropriate permissions to the Salaries list item
   • Point "CurrentSalary" column to the created list item
6. Add similar ItemUpdating event receiver

So, you will have two columns: one "Salary" will only receive new values for salary, the other "CurrentSalary" will be not editable and will only display the salary value.

Answer 2

I'd probably work it so there was a default list everyone could access, employees and managers. Then create a second list that had strictly the sensitive information that only the managers had access to. In this secure list, I'd create a lookup to the general list to create a link to the user. Then fill in all the sensitive information.

The employee can see all his "public" information and all the sensitive information is restricted and isolated so only the proper people can access it. It doesn't require any custom code or other dependancies.