We have a SP 2010 system. We recently discovered that users with no permissions to a library are able to open documents in a library if provided with a direct url link to the document, thereby appearing to bypass any permissions that have been set in the library. But if the users are supplied with a document id link to the same document their lack of permissions are respected and they will get access denied as one would expect. Has anyone come across this kind of behaviour before? Any help would be greatly appreciated as this is a major security hole.
2 Answers
If you've already checked the following my apologies for suggesting it:
For the document (or documents) in question, can you verify that they have not had permissions broken off from the library ? If they are in a folder, also check that the folder hasn't had it's permissions broken off.
I've seen what you are describing when the document had broken permissions off from the library. User could go straight to the document (in my case a word document) but obviously could not go to the library and browse. As for the document id link: This probably tries to open up other assets in the library or site to which the user doesn't have permission (the document ID link is probably trying to open up a display page for the properties of the document which might pull images, scripts, etc. to which the user doesn't have access).
Problem solved. It turns out a previous developer who had developed for us a library provisioning tool for some inexplicable reason decided to set the alloweveryoneviewitems property to true in the code. This meant every library we have provisioned in our system had this value set to true. Easy to fix with powershell script changing the value to false - problem no more.