7

I have a site that only allows specific users to access. However, if a user with no access goes directly to a list view page, they see the view (although it doesnt actually show any of the list items). If they go to the homepage of the site, they get the expected access denied.

I suspect this is due to NT AUTHORITY\authenticated users existing in Style Resource Readers. Why does this allow list views to be seen?

Improve this question

1 Answer 1

Reset to default
6

"The Style Resource Readers group contains a Windows security group named NT Authority/Authenticated Users. This means that all authenticated users can display SharePoint master pages and styles for the pages on your site."

There is several styles to choose from when creating/modifying a list view, and for the style to render for a user, he or she must have access to the style library. That's why.

It's recommended to not change anything in the Style Resource Readers group.

This is a great blog post showing all the available list views and maybe clear things up a bit.

SharePoint: List View Styles

Improve this answer
2
  • Thanks for the answer. I would still say that to give access to the list views (and hence stop security trimming working where linking direct to a list view) just so someone can pick a style if they even had permission is a bit weird.
    – dmce
    Commented Mar 12, 2014 at 15:29
  • Ive read you shouldnt edit the Style Resource Readers group, but couldnt it just contain a group that allowed read access to the site to achieve the same thing
    – dmce
    Commented Mar 12, 2014 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.