Restrict Visitors from Importing WebParts

Question

We have a MOSS 2007 site where the Visitors are allowed to personalize their home page. They are allowed to add only 2/3 webparts and we did this by managing permissions in the Web Part gallery.

This works fine. A normal user is able see only 2/3 webparts in the Add WebPart window.

Issue :

I log in as a normal user. Add WebPart dialog shows only 3 Webparts which is good but if I add the query string "Toolpaneview=2" to the URL I will be redirected to the Edit mode which has options to Add Webpart (Similar to http://blog.drisgill.com/2008/10/extremely-helpful-hidden-web-part-menu.html )

This has "Import" option which will let me upload WebPart or dwp files and add it to the page. is there any way to block this option?

Answer 1

The view from Microsoft is not to offer this feature.

If you want to avoid the risks associated with import, you can disable the feature altogether simply by not using the server control that implements it. Or you can limit what users have access to the control. For instance, you could use role management, and if a user is in the administrator role, you could programmatically add the ImportCatalogPart to the page for that user.

I can't think of anything else, unless there's a way to block uploads of dwp files using an Infrastructure trick. Otherwise you'll have to rely upon Security by Obscurity which you wisely seem keen to avoid.