1

I have a list which is used by HR for Training. The employee name, course, cost of course are some of the field names.

I have restricted users to only see their own items by using a People Picker field filtered on [Me]. Users can not see the Cost field in their view either.

The HR manager has a HR view which includes the 'Cost' field - only the HR manager can use this view, it is restricted through the use of audience targetting (by this I mean: Target Audience Settings (Edit Page/Edit Web Part/Advanced/Target Audiences/HR Manager Name). So far so good.

This is my question - how do I disable the 'create view' option, so that users do not simply create a new view and add in the 'Cost' field?

Does this come down to the permissions that the user group has? Does a user with only 'View' or 'Read-only' permissions have the option of creating a view?

Improve this question

4 Answers 4

Reset to default
2

"Manage Personal Views"

"Manage Lists"

These are the permissions within a permission level that allow users to create personal views, and public views. If you want to keep users from being able to add that 'Cost' field, then make sure your permission level (custom or otherwise) does not allow these 2 options. The 'View Only' permission level that normally the 'Visitors' group has on a site does not have access to these options. That should work nicely in this situation.

Improve this answer
3
  • Thanks - this is the way I have configured the list now. I created a new permission based largely on the OOTB 'restricted read' permissions but removed permissions listed under the Personal Permissions heading. Under the List Permissions header I enabled View and Open Items. Under the Site Permissions I have enabled View Pages; Use Remote Interfaces; Use Client Integration Features and Open.
    – Tally
    Oct 2, 2017 at 8:31
  • I found users could still see the sensitive 'Cost' field via the 'view item' page. I thought I'd add this as a comment in case other users were trying something similar. Since I could not seem to achieve the desired result through the SP menu, I had to resort to using jquery to hide the 'Cost' field from the page. I'll add the jquery as a separate answer in case someone else wishes to use it.
    – Tally
    Oct 3, 2017 at 11:42
  • Ah, yep, that is true, as the restriction of the ability to create/edit views does not protect specific fields. The answer given was specific to your question, but not specific to your purpose for doing this. You can also use SharePoint CSR (client side rendering) with JSLink to rig up a way to protect the Cost field, but it would essentially be what you are doing with your SPServices-based code.
    – spguy
    Oct 3, 2017 at 14:12
2

Best way to do this would be to create a custom security setting and new permission group. There is a check you can undo for users within the security settings that will not allow them to create views. You can have it for this list and break inheritance with the parent site permissions and use your custom permissions settings with a new security group.

Improve this answer
1

For greater security, you could remove the cost column from the original list, create a second identical list with a cost column and change its permissions so only the HR manager will be able to access it.

A workflow could copy the items from the first list to the second list where the cost information would then be added.

Improve this answer
1
  • Thanks for the answer. I did think about doing something like this. I didn't mention it in my question but the list I'm working on is already using lookup fields to two other lists, so I was looking to avoid using another. As you suggested, creating an additional list would be foolproof for security, so would be an option for HR, it gives an additional option should they wish it to be done this way.
    – Tally
    Oct 2, 2017 at 8:15
0

(Following on from my most recent comment) - using jQuery to hide the 'Cost' field. The jqQery cross-checks the user name against a SP user group. If the name is not in the group, the Cost field will be hidden.

Someone else other than me came up with this code, I'm not a programmer.

The key parts, as I understand it, are the find("Group[Name='HR editors']") which checks to see if the logged on user is in the group named HR editors.

If the user is not in the group, this bit of code hides the Cost field. 

jQuery('h3:contains("Cost")').closest('tr').hide();

note - The 'h3' part of the code refers to html; selecting the correct field was a bit tricky. This code was originally used elsewhere in our SP Farm and needed to be adapted, the 'h3' substitutes another tag.

Here is the code. 

<script src="https://yoursitename.com/yourfolderlocation/yourfilename" type="text/javascript"></script> 
<script language="javascript" type="text/javascript">

jQuery.noConflict();
jQuery(document).ready(function(){
  jQuery().SPServices({  
      operation: "GetGroupCollectionFromUser",  
      userLoginName: jQuery().SPServices.SPGetCurrentUser(),  
      async: false,  
      completefunc: function(xData, Status) { 
        //if current user is not a member of this group...       
        if(jQuery(xData.responseXML).find("Group[Name='HR editors']").length != 1)  
        {  
           jQuery('h3:contains("Cost")').closest('tr').hide();
        }  
      }  
    });  
});
</script>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.