0

I have a publishing site in which there are several lists and libraries.

I am displaying some list and libraries on home page and applied XSLT on them to give them desired look and feel.

There is a group called "Readers" which only has READ ONLY rights on site.

They can view the site but problem is they can also directly access the list as follows. I know they only have read only rights so they cannot do anything but still I don't want users be able to access lists directly or shall I say access system pages.

http://myserver/Lists/MyList/Allitems.aspx

If I give those users RESTRICTED READ rights they they cannot access the lists directly but then they can't browse site either.

  • I suppose you could audience target the list view if you edit the allitems.aspx page to include the SP groups you want to be able to see the content directly. – Eric Alexander Dec 13 '13 at 16:28
2

AFAIK, It is not possible to do what you want to do, for fundamental reasons. The user controls the client. From the server side, the server has no way to distinguish a legitimate user from browser that happens to be making a request for the library(a case where you want to serve the file) from the same user who is trying to directly access the library(a case where you don't want to serve the file). These two situations are indistinguishable from the server's point of view, so the server has to behave the same way in both cases: either serve the library in both cases, or don't serve it.

You can only decide whether a user has access to the library or not, you cannot control what a determined user does with the library.

| improve this answer | |
  • That's what I also thought. Because you see this AllItems.aspx file is used by all users who come to this page. So depending on user permissions SharePoint shows different options. If I somehow disable access to this page then it will affect all users. – Frank Martin Dec 14 '13 at 8:03
0

One of the possible way can be to restrict the user using HTTP module. But you need to wisely decide on this as it can hamper the performance of your site.

In HTTP module you can read the url and have conditions in place for navigating the user to some other page with the message..."You are not allowed to view this page".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.