0

Having created a SharePoint Hosted App which allows users to add records to a list i noticed that the list is accessible via the URL if the user knows the name of the list.

If you access the list in this way you can see ALL the entries in that list, including items that you did not create. This is a major security flaw for me, is there a way to stop this?

**I should have mentioned that my app has a requirement whereby certain number of users (multiple, i.e. Manager, Approver and Director) will require access to a particular item to help in the approval process.

**

S

Improve this question
3
  • Can't you just go into list settings > advanced settings > item-level permission and set it to Create items and edit items that were created by the user?
    – eirikb
    Commented Apr 23, 2014 at 14:13
  • see edited content
    – Stephen
    Commented Apr 23, 2014 at 14:30
  • Are you able to remove read permission for the user, but still add items when going through JSOM or REST? If so, and I think that might be the case because of app permissions, you should be able to set item level permission for the user to access their own items on creation. Also, if you are able to retrieve items from a locked down list through the JSOM/REST app proxy you could just give some groups access (i.e., Manager) and forget about item level permission as you can retrieve items through the app
    – eirikb
    Commented Apr 23, 2014 at 18:32

2 Answers 2

Reset to default
2

You have a ListTemplate (List Definition) item defining your custom list, I assume.

In the ListTemplate element you can make use of SecurityBits attribute to have some control on this. Please refer to MSDN about the available options for SecurityBits

http://msdn.microsoft.com/en-us/library/office/ms462947(v=office.15).aspx

I think this is the highest control/restrictions you can apply to your App-web's lists

For instance:

   <ListTemplate
    Name="MyListTemplate"
    DisplayName="MyListTemplate"
    Type="10001"
    BaseType="0"
    OnQuickLaunch="TRUE"
    SecurityBits="22"
    Sequence="420"
    Description="My List Definition"
    Image="/_layouts/15/images/itgen.png"/>
Improve this answer
1
  • To make my answer more complete: it's also possible to control unique permissions for the list or list items in the app-web lists, but this isn't available in the SharePoint UI when in an app-web (List Settings ribbon button). Controlling list's permissions via CSOM / REST APIs gives us the same interfaces and possibilities we have available for 'normal' SharePoint lists residing for instance in the host site. In case of a Provider-hosted this code can run on the AppInstalled event that our provider can register. For SP hosted likely a PowerShell script to run on installation is the best way?
    – Massimo Prota
    Commented Nov 7, 2014 at 10:53
0

This is not unique to apps. This will happen in normal cases a s well. If users have permissions to read items in the list they can read the items in it. You simply need to edit the permissions of the users who can see / not see the items.

Improve this answer
2
  • Does this mean that i need to break inheritance on the list/list item and then manage the permission on an item as I create it?
    – Stephen
    Commented Apr 23, 2014 at 14:44
  • Depends on what you really want.
    – Nadeem Yousuf-AIS
    Commented Apr 23, 2014 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.