Edit
I found out that the profile.js and aboutcarousel.js files are referenced in the master page:
<SharePoint:CssRegistration Name="Themable/corev15.css" runat="server" />
<SharePoint:CssRegistration Name="/SiteAssets/css/ITDcore.css" runat="server" after="corev15.css"/>
<SharePoint:CssRegistration Name="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" runat="server" after="corev15.css"/>
<!-- Custom Scripts -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js">//<![CDATA[//]]></script>
<script type="text/javascript" src="/SiteAssets/js/Profile.js">//<![CDATA[//]]>
</script>
<script type="text/javascript" src="/SiteAssets/js/AboutCarousel.js">//<![CDATA[//]]>
</script>
<!-- End Custom Scripts -->
These 2 js files are the ones the Visitors cannot see. I modified the Visitors permission to Contribute and they were able to see both displays. I changed back to Read and the profile and carousel disappeared again.
I also found out that if I add either one of the following List Permissions to default Read, user can see the displays:
- Add Items
- Delete Items
- Edit Items
The weird part is during testing, its very inconsistent which one gives the right permission. Sometimes Add Items work, sometime it doesn't while Edit Items would, or vice versa. BUT, Visitors shouldn't have any of these List Permissions. Is the custom script added incorrectly in the master page? It works with at least contribute permission...
Work around:
I gave visitors Contribute permission in the Master Page Gallery -- not sure if this is the best practice...
I have the following security groups in sharepoint:
- Members (contribute)
- Owners (full control)
- Visitors (read)
However, visitors cannot see some of the web parts (script editor). I checked and user in Visitors group can access the Site Assets, Site Pages, and Photo Gallery which are referenced on the script.
But when I added the test account to the Members group - test account was able to see the web parts. Target audience for the web part is blank.
Other tests and results:
- Changed Visitors permission from read to View Only, Contribute, or Full Control - same results, cannot see the same web parts.
- Created another security group - still same result.
- Gave permission to the test account individually (not part of Members, Owners, Visitors) - test account got an access denied message after browser refresh.
- Same results in IE, Edge, and Chrome
Any ideas what could be causing this odd behavior?
