Personalizable web part custom property not shown for users with Contribute permission level

Question

I've create the Web Part for SharePoint 2010, which contains simple custom property with PersonalizationScope.User. Web part inherited from the System.Web.UI.WebControls.WebParts.WebPart

private int _mainBodyBorderWidth = 0;
    [Personalizable(PersonalizationScope.User),
     WebBrowsable(true),
     WebDisplayName("Main Body Border Width"),
     WebDescription("Set main body border width"),
     Category("Style")]
    public int MainBodyBorderWidth
    {
        get
        {
            return _mainBodyBorderWidth;
        }
        set
        {
            _mainBodyBorderWidth = value;
        }
    }

When Site Administrator or users with permission Add and Customize Pages click "Personalize Page" and than "Edit My Web Part" this property is displayed in the web part tool pane. However users with standard permission level "Contribute" can't see this property.

Answer 1

After reading this article and some investigation I get following results about SafeContol tag for the web part. The following considerations must be applied for the web part which user without permission Add and Customize Pages can add/remove or modify.

1. In SP 2010 TypeName attribute of the tag should use particular type name instead wildcard.
2. Attribute Safe set to "True"
3. Attribute SafeAgainstScript also set to "True" And SafeControl tag will look similar to this:

<SafeControl Assembly="Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" Namespace="Microsoft.SharePoint.WebPartPages" TypeName="ListViewWebPart" Safe="True" SafeAgainstScript="True" />

However VS 2010 by default generate wildcard "*" for the TypeName attribute, and "False" value for the SafeAgainstScript attribute of the Web Part item. So you need change in the Web Part item Properties Safe Control Entries collection entry with particular type name and "SafeAgainstScript" property right value.

Answer 2

The default SafeAgainstScript=false provides protection against XSS attacks.

When switching this attribute to true you need to be aware of the implications.

This article provides a good summary

Haytham speaks from Microsoft