If you set the SPList.Hidden property to true, the list isn't shown in the Quick Launch, All Site Content, Lookup lists, etc. However, it is still possible to navigate to the list by typing in the list's URL, or by using an old bookmark.
So how do you actually hide a list, so that it won't display under any circumstances?
I ran into the same requirement in a recent project, basically preventing access to any list view or form of a particular (hidden) list via the Web browser.
SharePoint designer isn't allowed on Web Application level and Web services (including client object model) is blocked by a custom HTTP handler, so the concerns mentioned in other answers didn't apply to this project.
Removing permissions was not an option because lookup fields of the list are used on other lists and should work for anybody, but accessing the list itself shouldn't be possible.
Instead of the tedious task of messing with URL-rewriter rules on the IIS server or a custom HTTP handler, which has several disadvantages as described later, the solution was to develop a custom SharePoint DelegateControl as described here
The DelegateControl contains code to check for a particular SharePoint group membership. If the current user isn't a member the following code blocks access to the list view & forms ASPX pages (note that the code has been simplified and might need more polishing):
string currentUrl = Request.Url.ToString().ToLower();
SPWeb currentWeb = SPControl.GetContextWeb(Context);
SPList currentList = SPContext.Current.List;
if (!currentUrl.Contains("/_layouts/") && (currentList != null && currentList.Title == "Your List Name"))
{
Response.Clear();
Response.StatusCode = 403;
Response.Status = "403 - Forbidden";
Response.StatusDescription = "Access is denied";
string accessDeniedPage = SPUtility.AccessDeniedPage;
string redirectUrl = "/_layouts/" + accessDeniedPage + "?Source=" + currentUrl;
Response.Redirect(SPUrlUtility.CombineUrl(currentWeb.Url, redirectUrl), true);
}
Unlike a custom HTTP handler the custom SharePoint DelegateControl will only fire its code when an ASPX page is hit which IMHO is a big advantage because the HTTP handler fires on every single request (even a JS/CSS/GIF etc. file) which puts additional load on the SharePoint Web frontend, plus the deployment of a HTTP handler is cumbersome because it has to be added to each web.config (including each extended Web Application) either manually or by writing a proper custom feature event receiver handling all the web.config modification heavy lifting. Because of those reasons I take HTTP handlers only as last resort ;-)
The above approach is working just fine even on a high volume Web site for more than a year now.
WebControl derivative, which I've inserted directly into the custom master page. Works beautifully, thanks.
You can access all sorts of things in SharePoint by typing in a url or by merely changing the querystring. If the list must be hidden always, then change security on the list so that only those with proper permissions can see it.
If you really are set on this, you can also implement some form of URL Rewriter on the IIS server hosting SharePoint and block requests for that list, though that can be a bit annoying to maintain across a farm.
Hmmm... couple of ideas come to mind, although neither is particularly awesome.
1) Create a custom HTTP handler that detects if a user is browsing to one of the list url's and redirect the user
2) Link a javascript file in your master page that does the same thing (checks the url to see if it contains /Lists/YourList) and redirect the user somewhere else.
There may be a more elegant approach, but I'm still drinking my first cup of coffee...
The problem is, that the list EXISTS.. so unless you set the permissions where NO ONE can get to it, a user that knows the url can get to it.
good luck, Mark
You can't. You can however remove all permissions so that no one besides SiteCollection administrator have access to it.
It should be pointed out that, without touching the permissions, just because it is hidden or redirected in the UI does not mean it is not accessible through other means.
SharePoint designer, web services, object model, etc. will still see it. It's the old 'security through obscurity' discussion.
If hiding is all you want, SPList.Hidden and Mark's 2nd option will do it.
