1

below is my script to break inheritance of a list item in SharePoint. I am facing the following issue. I have a form, where users submits request through it. All users are in a group called Site Visitors (having a DL, Site is our Site name) having contribute access to Site and list .We have approvers groups having contribute access and other groups with full control access.

****When a user submits a request, the break inheritance is not working and all users in Visitors list is having access to this item. Our requirement is to view the request to the createdby user and approvers only.

The break inheritance is working if the user is from one of the full control group.***

Can you please let me know what mistake I am doing?

var siteUrl = '/sites/MySiteCollection';

function breakSecurityInheritanceAddUser(listItemID) {

    var clientContext = new SP.ClientContext(siteUrl);
    var oList = clientContext.get_web().get_lists().getByTitle('MyList');

    var itemId = listItemID;
    this.oListItem = oList.getItemById(itemId);

    oListItem.breakRoleInheritance(false);

    this.oUser = clientContext.get_web().get_currentUser();

    var collRoleDefinitionBinding = SP.RoleDefinitionBindingCollection.newObject(clientContext);

    collRoleDefinitionBinding.add(clientContext.get_web().get_roleDefinitions().getByType(SP.RoleType.Contributor));
    var groupCollection = clientcontext.get_web().get_siteGroups();
    var Approver1_group = groupCollection.getByName("Approver1");
    var Approver2_group = groupCollection.getByName("Approver2")
    this.oListItem.get_roleAssignments().add(oUser, collRoleDefinitionBinding);
    this.oListItem.get_roleAssignments().add(Approver1_group, collRoleDefinitionBinding);
    this.oListItem.get_roleAssignments().add(Approver2_group, collRoleDefinitionBinding);

    clientContext.load(this.oUser);
    clientContext.load(this.oListItem);

    clientContext.executeQueryAsync(Function.createDelegate(this, this.onQuerySucceeded), Function.createDelegate(this, this.onQueryFailed));
}

function onQuerySucceeded(sender, args) {

    alert('Role inheritance broken for item ');
}

function onQueryFailed(sender, args) {

    alert('Request failed. ' + args.get_message() + '\n' + args.get_stackTrace());
}
0

Contribute does not allow to break role inheritance, they must have Edit at least.

There is an out of the box approach that might be an alternative here (in addition to giving the users more permissions). If you turn on content approval + minor versions in your list - users can only see items they created themselves unless it is approved:

enter image description here Of course if the approvers actually approve the items they will be visible for all...

Additionally, if this is not a document library there is a setting under advanced that will do this for you:

enter image description here

| improve this answer | |
  • Sorry one more thing to clarify is break inheritance is working for only people submit request who are having full control – ram 369 Mar 20 at 0:38
  • I have tried with Edit access also, it didn't work. Can you please let me know if I can do anything within the script – ram 369 Mar 20 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.