Preventing users from deleting an item from a task list

Question

I am using the ItemDeleting event receiver to prevent users from deleting items in a Task List.

Currently, my code looks like:

        if (properties.ListTitle == "Project Intake Tasks")
        {
            properties.Cancel = true;

        }

And this works but it results in a "<nativehr>0x81020089</nativehr><nativestack></nativestack>An event receiver has canceled the request. " error when a user tries to delete a task from the Task Item Edit page. Is there a way to get rid of this error or to grey out the Delete Item button in the Task Item Edit page?

Note: I tried to set custom permissions for the list but could not find a specific "Delete Item" permission level as talked about here http://office.microsoft.com/en-us/windows-sharepoint-services-help/permission-levels-and-permissions-HA010100149.aspx.

Is there a specific Item Delete permission level for lists that I just can't find?

Answer 1

It looks like if you go into Site Settings > Site Permissions > Edit > Permission Levels > Add a Permission Level you can create a custom permission level that lets user do everything but delete an item. Then apply that custom permission level to all the users and groups of the task list.

Answer 2

A couple of things:

You can't create the permission level for a single list, but you have to create that a Site Collection level as @Meyer describes (usually by making a copy of Contribute and remove Delete Item), then you can break permission inheritance on that specific list and remove Contribute from people/groups and add your custom permission level instead.

You may still want to keep the event receiver in place to protect against site collection admins (and changed permissions)

If you don't want your event receiver to show a nasty error, then you have the option of setting properties.Status to SPEventReceiverStatus.CancelNoError instead of setting Cancel this will cancel the action but not show anything to the user (which may confuse them very much) or if you're running 2010 then you can set the Status to CancelWithRedirectUrl and specify a page with a nice error message as RedirectUrl

If you only want to protect a single list then it's a lot better to only register your event receiver to that single list instead of all lists of that type.