4

SharePoint 2007 Document Library has permissions set for user A to "Read". User A is able to go to Actions -> Open in Windows Explorer and delete files. This seems like a very large security loop hole.

We do not want to remove the Open in Windows Explorer option so is there any way to enforce permissions in this setting?

Improve this question

2 Answers 2

Reset to default
1

I had the same feeling when using the "Open in Explorer" in SharePoint 2010. User could remove docs in the Explorer view. But when refreshing the documents were still there, so the user could in fact not delete them...

Improve this answer
1
  • Thanks, this was very helpful. I had the users test this and it was true. Fears have been alleviated.
    – jethomas
    Mar 21, 2012 at 15:30
1

If User A is logged in as User A (Read Only) in SharePoint, but is logged into their machine as User B (Full Control) then the permissions will be different than expected. Explorer View uses the credentials of the user logged into the machine, NOT the credentials currently used in SharePoint.

This is likely what is causing the confusion (especially if you are testing on your machine). The Explorer View is still respecting the library's permissions, but you may be presenting different credentials than you thought.

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.