I found out that the profile.js and aboutcarousel.js files are referenced in the master page:

    <SharePoint:CssRegistration Name="Themable/corev15.css" runat="server" />
<SharePoint:CssRegistration Name="/SiteAssets/css/ITDcore.css" runat="server" after="corev15.css"/>
<SharePoint:CssRegistration Name="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" runat="server" after="corev15.css"/>

<!-- Custom Scripts -->
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js">//<![CDATA[//]]></script>
<script type="text/javascript" src="/SiteAssets/js/Profile.js">//<![CDATA[//]]>
<script type="text/javascript" src="/SiteAssets/js/AboutCarousel.js">//<![CDATA[//]]>
<!-- End Custom Scripts -->

These 2 js files are the ones the Visitors cannot see. I modified the Visitors permission to Contribute and they were able to see both displays. I changed back to Read and the profile and carousel disappeared again.

I also found out that if I add either one of the following List Permissions to default Read, user can see the displays:

  • Add Items
  • Delete Items
  • Edit Items

The weird part is during testing, its very inconsistent which one gives the right permission. Sometimes Add Items work, sometime it doesn't while Edit Items would, or vice versa. BUT, Visitors shouldn't have any of these List Permissions. Is the custom script added incorrectly in the master page? It works with at least contribute permission...

enter image description here

Work around:

I gave visitors Contribute permission in the Master Page Gallery -- not sure if this is the best practice...

I have the following security groups in sharepoint:

  • Members (contribute)
  • Owners (full control)
  • Visitors (read)

However, visitors cannot see some of the web parts (script editor). I checked and user in Visitors group can access the Site Assets, Site Pages, and Photo Gallery which are referenced on the script.

But when I added the test account to the Members group - test account was able to see the web parts. Target audience for the web part is blank.

Other tests and results:

  • Changed Visitors permission from read to View Only, Contribute, or Full Control - same results, cannot see the same web parts.
  • Created another security group - still same result.
  • Gave permission to the test account individually (not part of Members, Owners, Visitors) - test account got an access denied message after browser refresh.
  • Same results in IE, Edge, and Chrome

Any ideas what could be causing this odd behavior?

  • Is this script placed in HTML code for visitors? What are check in/check out statuses for script and page?
    – AlexZh
    Jul 4, 2018 at 6:20
  • Check if the js files are checked in. Check if the page itself is checked in, check if the webpart is actually on the page for all users and not on a personal view (Append ?contents=1 to the page URL) Edit: since you granted full control I guess the Webpart is on a personal view... Jul 4, 2018 at 7:05
  • It sounds similar to an issue I have experienced. You could try checking whether users have access to the Style Library.
    – Tally
    Jul 4, 2018 at 8:06
  • @AlexZh, there are no check in/check out. The codes are all in Site Assets, which has inherited permission. Jul 5, 2018 at 16:54
  • @HeikoHatzfeld_MSFT, the Script Editor only has `<div id="cardplaceholder"></div>~ in it, which is part of the code in CEWP (as a txt file) which is located in Site Assets. Jul 5, 2018 at 16:57

1 Answer 1


This can be caused by having the master page not published as a Major version. To be sure check out/in and then publish as a major version. If it is HTML design file associated you should perform the actions on it.

And I agree that granting contribute to the master page gallery is not a good practice.

  • Thank you James. It worked! I reverted the permission settings for Master Page Gallery. Jul 9, 2018 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.