1

Have a document library in MOSS 2007. Item-Level permissions are not surfaced in the default SharePoint UI for Document Libraries, however the WriteSecurity and ReadSecurity properties are available from the SPList corresponding to the list in the OM.

We have set our Document Library for WriteSecurity = 2 (only their own) through code.

When I perform a functional test on this, however, I am able to delete another user's documents.

While researching this, it looks like there is a few popular blog posts indicating that setting the WriteSecurity property through the OM should be sufficient, such as this one here:
http://blogs.pointbridge.com/blogs/morse_matt/Pages/Post.aspx?_ID=8

It appears, however, that SharePoint isn't respecting this setting for Document Libraries. I've confirmed it does for at least one other list type: Links.

Is the solution to create an event receiver to do one of the following:

  1. On the "Before" Delete/Edit events, ensure the user performing the action is the appropriate person, and if not, cancel the event?

  2. On an Item Added "After" event, remove all permissions from everyone but the person who created it.

Also, does this story get better with SharePoint 2010?

Improve this question
1

1 Answer 1

Reset to default
1

The read/write security settings do not apply if you have the 'manage lists' permission on the list. Did you try your test using a low privileged account?

Improve this answer
4
  • Yeah, I confirmed that there are no higher level perms. The users both have the following in their permission set: Add Items Edit Items Delete Items View Items Open Items View Versions Delete Versions Create Alerts View Application Pages I also tested the same set of permissions on a Links list and it worked as expected (i.e. user was not able to delete other user's link).
    – Brian
    Aug 19, 2010 at 22:34
  • Ok... I tested it myself and it looks like the WriteSecurity property is ignored on document libraries (if ReadSecurity is set to 2 though it works). Perhaps that is why the property is not availble through the UI.
    – Paul Lucas
    Aug 20, 2010 at 0:32
  • Right, so I don't understand why this blog post (though old) makes it seem like it should work: blogs.pointbridge.com/blogs/morse_matt/Pages/Post.aspx?_ID=8. Guess you cannot just take what you read on someone's blog as truth. So, assuming this is correct, what is the best way to achieve this? One of the options I suggested? Other?
    – Brian
    Aug 23, 2010 at 3:03
  • Yep the difference with the referenced blog post is that he is setting both the ReadSecurity and WriteSecurity to 2. In that case it will work, because you cannot get access to another users documents in order to delete them. As you suggest, I'd try going with an event receiver for the library to set permissions.
    – Paul Lucas
    Aug 24, 2010 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.