0

I have developed one SharePoint site for Performance Review.

Site has custom html page with jQuery that creates/updates record using REST and that page is blinded using ASPX page. (I will explain the functionalities used in this page at end of this question)

I have given edit permission to all end users so that they can create/update record in performance review list using ASPX page. (validation on custom page are handled manually).

for hiding the performance review list data from end users I have given audience targeting on all items view of the performance list

I feel that I can develop something better, secured then what I have developed, I need your suggestions to know how can i build this better.

I have SharePoint 2013 and SharePoint Online, please suggest for both.

About custom HTML Page

It has sections as below,

  • Section 1 Employee Comments
  • Section 1 Employee self rating
  • Section 1 Manger comments
  • Section 1 manager rating

such 4 sections are there. when employee opens the form, manger columns are hided using jQuery. when manager opens the form, manger columns are shown and employee columns are turned read only using jQuery.

How I identified when to open same form as employee and manager

When employee fills the form and submits (when record is created), the designer workflow sends as email to manger containing link with one parameter(employee_unique_id). jQuery will check that the parameter is passed so it will open manager related columns for manger to fill up.

Improve this question
0

Why not use existing New, Edit & Display form of list. Here is approach,

  1. Create list Performance and add columns for all sections.
  2. Now open list into designer and edit new form.
  3. Create section using div and write some css for cosmetic makeup.
  4. Use same logic to hide sections or you can use user properties and check if item created user's manager is equal to current user then show only manager section.
  5. Repeat same logic for Edit and Display form or save logic in JS file reference it.
Improve this answer
  • This form also create/udpate goal related details on different list. This same form communicates with employee master to get details while loading the form. also it has jQuery where I have used deferred and success method for synchronous calls. will this be possible with approach you are suggesting. how will we provide access to HR so that they can see all records of the performance list and employee can see their own records only. – Omi Jul 16 '19 at 5:28
  • Yes you do all customisation on these forms. Why do you have employee master? any specific reason? employee can be directly fetch from AD. Employee can only see their: Go to List setting>advanced setting> Item level permission. – Anil Pal Jul 16 '19 at 5:58
  • there are columns like grade, temp address, permanent address and many other fields which are not there in Active directory so there is separate employee master. Employee master has one people picker column so that we can link to AD of the employee. refer the screenshot of the form here paste.pics/48ac07f8de6c92555f77a8719ca4f127. it has functionalities like save as draft also which is manages flag and send notification manager only when user click on save and submit. can same designed be achieved in OOTB edit form? – Omi Jul 16 '19 at 7:12
0

This is a bad idea. Your jQuery modifications can be easily bypassed by anyone with moderate web development knowledge. Audiencing can also be easily defeated. You could theoretically secure each review to the appropriate people but this will be a mess and you cannot secure by fields.

My advice - do not use SharePoint for this system. Build your own from scratch or use a 3rd party tool.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.