We have a MOSS 2007 site where the Visitors are allowed to personalize their home page. They are allowed to add only 2/3 webparts and we did this by managing permissions in the Web Part gallery.

This works fine. A normal user is able see only 2/3 webparts in the Add WebPart window.

Issue :

I log in as a normal user. Add WebPart dialog shows only 3 Webparts which is good but if I add the query string "Toolpaneview=2" to the URL I will be redirected to the Edit mode which has options to Add Webpart (Similar to http://blog.drisgill.com/2008/10/extremely-helpful-hidden-web-part-menu.html )

alt text

This has "Import" option which will let me upload WebPart or dwp files and add it to the page. is there any way to block this option?

1 Answer 1


The view from Microsoft is not to offer this feature.

If you want to avoid the risks associated with import, you can disable the feature altogether simply by not using the server control that implements it. Or you can limit what users have access to the control. For instance, you could use role management, and if a user is in the administrator role, you could programmatically add the ImportCatalogPart to the page for that user.

I can't think of anything else, unless there's a way to block uploads of dwp files using an Infrastructure trick. Otherwise you'll have to rely upon Security by Obscurity which you wisely seem keen to avoid.

  • Thanks Neil. How can I remove this Control? I coulnd't find this in the masterpage. Any ideas?
    – Shoban
    Commented Feb 1, 2011 at 19:58
  • So I'm not sure where its getting rendered. What I would suggest is embedding a control in the page to find out just where the control is stored within the control tree. From there you will hopefully get a better sense of how to remove it. It sure seems like a bloody great security risk though. Commented Feb 1, 2011 at 21:46
  • Are you sure that restricting access to the webpart gallery isn't sufficient? Does the dwp go into the page or the gallery? If it goes into the page then I'm a bit stuck. Should also highlight that in reviewing the link posted above it refers to .net webparts and not SharePoint ones. Commented Feb 1, 2011 at 22:11
  • It goes to the webpart and not webpart gallery. The link above was for ref purpose but I am also able to upload SP webparts.
    – Shoban
    Commented Feb 1, 2011 at 22:25
  • Sorry I meant.. the webpart goes to the page and not the webpart gallery.
    – Shoban
    Commented Feb 1, 2011 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.