1

For our SharepointOnline website we'd like to set item level permissions on a document library. The goal is that the user can:

  • view all the documents in the library
  • create (and upload) new documents
  • edit their own documents
  • no delete permission (only an administrator will be allowed to delete documents)

We cannot set item level permissions on document libraries through the UI but it is possible by using PowerShell. This is for on premise Sharepoint. Source: https://sharepoint.stackexchange.com/a/162308/70734

We want to be able to do this for our Sharepoint Online solution. An update to CSOM made it so we can manipulate the ReadSecurity and WriteSecurity properties on lists. Source: https://sharepoint.uservoice.com/forums/329220-sharepoint-dev-platform/suggestions/15147063-implement-rest-csom-api-method-for-setting-list-re


Initial situation:

Imgur

Updating ReadSecurity:

var expectedReadSecurity = 1;
clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
clientcontext.ExecuteQuery();
Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
if (list.ReadSecurity != expectedReadSecurity)
{
    list.ReadSecurity = expectedReadSecurity;
    list.Update();
    clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
    clientcontext.ExecuteQuery();
    Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
}

Output:

List: Reference documents - ReadSecurity 1 - WriteSecurity: 1
List: Reference documents - ReadSecurity 2 - WriteSecurity: 1

Result:
Imgur


Updating WriteSecurity:

var expectedWriteSecurity = 2;
clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
clientcontext.ExecuteQuery();
Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
if (list.WriteSecurity != expectedWriteSecurity)
{
    list.WriteSecurity = expectedWriteSecurity;
    list.Update();
    clientcontext.Load(list, x => x.ReadSecurity, x => x.WriteSecurity);
    clientcontext.ExecuteQuery();
    Console.WriteLine($"List: {list.Title} - ReadSecurity {list.ReadSecurity} - WriteSecurity: {list.WriteSecurity}");
}

Output:

List: Reference documents - ReadSecurity 1 - WriteSecurity: 1
List: Reference documents - ReadSecurity 1 - WriteSecurity: 2

Result:
Obviously, the document library still shows all the files. However, our user can edit all the files in the document library, not just his own ones (we are logged in with the green user). You can see that the 3rd document, created by BLUE can be edited by GREEN. Imgur


Question:

It seems the ReadSecurity in CSOM is correctly implemented and is doing as expected. However, the WriteSecurity property is not working as expected. Is this an oversight? Are we missing something here? A ticket was created to the Office365 team, but unfortunately they were unable to assist us in the issue.

2

Your referencing something that only exists in a list, it doesn't exist in document library:

WriteSecurity

https://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.writesecurity.aspx

this was valid for 2010/2013 but not for 365! you need to either have a custom app or be creative and create a workflow that assigns read only to the document. Its got some functionality due to document library is a type of list.

having fine grained permissions is not recommended and should only be done if necessary or as a custom solution

  • But a document library IS a list, is it not? The fact that ReadSecurity does what it is supposed to do, but WriteSecurity does not, bothers me. – Hemario Oct 9 '17 at 13:13
  • yes you are correct that it is a list but... a "form" of a list where it doesn't have everything that a normal list does hence why its available but not usable. Assuming they took it out due to security complexity with multi auth? saying that if you have access and power to use power-shell then you could give it a try as its still available that route but I would bet it wouldn't do anything. – Ali Jafer Oct 10 '17 at 8:38
  • PowerShell for manipulating SharepointOnline uses the same CSOM library (and the underlying REST endpoint) anyway. There is no difference calling the above code from a console app or from PowerShell. – Hemario Oct 10 '17 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.