Questions tagged [security]

Security is the protection of information and property from theft.

Filter by
Sorted by
Tagged with
0
votes
1answer
22 views

Site Permissions Flyout Menu

I'm curious why site permissions load on some sites and not others. This particular one doesn't show anybody but on another site, it shows Owners, Members and Visitor group memberships
0
votes
0answers
9 views

About Cross Site Request Forgery prevention on SharePoint 2016

We are using SP2016 on-premise. The Web Page Security Validation is turned on as default with Security validation expires = 30 minute. The SharePoint is installed on MyCompany.com intranet with NTLM ...
0
votes
1answer
29 views

SharePoint Online Site inherit security group from hubsite

Is there a PowerShell script/cmdlet (pnp/spo) to inherit securitysettings from hubsite? All sites linked to hubsite https://tenant.sharepoint.com/sites/marketing should have the same permission ...
0
votes
1answer
24 views

How to remove RoleAssignments from SPListItem/SPFolder correctly in SharePoint

In the library, I have ParentFolder which contains SubFolder. I have broken role inheritance in both ParentFolder and SubFolder (via a web interface). But when I remove role assignment for the user ...
0
votes
1answer
28 views

Custom web part unable to call custom web API

I'm unable to get my custom web part to connect to my custom Web API. Ultimately, my goal is to secure the API using Azure AD and then call that API from my web part. In the local workbench, I'm ...
1
vote
0answers
15 views

Why http PUT can upload file successfully to SharePoint?

We are using SP2016 on-premise. In order to handle security test I prepared a PowerShell script to test upload with PUT/POST. $Digest = $response.getcontextwebinformation.FormDigestValue $headers = ...
0
votes
0answers
143 views

FormDigest control problems after September 10, 2019 Security Update

I've noticed some weird behaviour of Microsoft.SharePoint.WebControls.FormDigest control after last security update. Control is added to every page by setting following code in masterpage: <asp:...
0
votes
0answers
12 views

Migrate SharePoint Column Encryption / Decryption using RSA Machine-Level Crypto

I'm actively trying to find the best way to migrate machine-level encryption to a new server that will be running SharePoint 2019. We use the RSACryptoService.cs to encrypt data being stored in a ...
0
votes
1answer
27 views

SharePoint 2016 Online Information List out of sync

Help! I'm adding users to SP Security Groups but they aren't updating on the Information List so users keep getting the Request Access page when then click on a link. First and most important how ...
2
votes
1answer
67 views

What exactly “manage trust” in CA is doing? (on-premise)

I have experience on setting up SP2010, 2013 and 2016. In order to install SSL cert and to support https to browse SharePoint, beside install the cert in IIS, usually we need to import the certificate ...
0
votes
2answers
26 views

Sharepoint 2013 limited access

quick question - we have a bunch of libraries from A to Z with broken permissions and dedicated SP groups to them only. The only issue we've got is with one particular library - all the other groups ...
2
votes
2answers
38 views

When opening a file, a warning 'insecure or coming from untrusted source' appears

I inherited SharePoint without knowing anything about it and it crashed hard a few weeks ago but we were able to restore most functionality and this is the only thing that is left. When I open any ...
1
vote
0answers
75 views

Excessive Vulnerability Count in Yeoman SharePoint Generator

When I run yo @microsoft/sharepoint and pick standard options for a SharePoint Online WebPart with No JavaScript framework, NPM shows 1956 vulnerabilities with 140 of them being high priority. I ...
0
votes
1answer
31 views

Allow files to be shared, with a label

Label within AIP/ARM can be used to restrict sharing with external users. But is there a way to do the opposite? So I would like to allow users to share specific files when a certain label is added. ...
0
votes
0answers
13 views

Office Online Server - Permissions Configuration

Is there a way to control which buttons are visible within the OOS Iframe? For example, if I wanted to block certain users from downloading the link, what would be the best approach for me to remove ...
0
votes
1answer
12 views

setting up and limiting access to specific fields in a record

We have 3 different groups of people who are adding data to a table or group of tables. We need to restrict viewing of the data at the field level for 2 groups of people. We also have a need to ...
0
votes
1answer
34 views

Sharepoint Online: How to display internal corporate websites, without HTTPS?

We have several internal web applications that do not require the HTTPS protocol, as they are purely accessible internally within our intranet. Obviously with Sharepoint Online, our websites will not ...
0
votes
0answers
101 views

Can I disable “Allow double escaping” on a SharePoint web site?

We're working on hardening our SharePoint server, and STIG V-76825 IISW-SI-000229 mandates that "Double encoded URL requests must be prohibited by any IIS 8.5 website". Basically, editing the Request ...
0
votes
1answer
68 views

html or javascript code injection in sharepoint

How safe is SharePoint with Code injection (HTML,Javsscript, SQL) because for example the Announcements list allows to enter embed Code in the TextBox. Can this be a threat or SharePoint is already ...
0
votes
0answers
13 views

guests users AAD, SecurityGroups and unique permissions

We are having a tenant with like 60 external guest users (added them as #EXT# in AAD) In order to control and manage these users I'm putting them in O365-securitygroups, after they accepted the ...
0
votes
1answer
38 views

Is there anyway to restrict FOLDER access by IP address?

We want to publish some Data for our team, this Data is restricted to only team members, but, we want them to access it only by 1 IP without restricting access to other folders.
0
votes
1answer
39 views

Creating a secure .Net WebAPI for Sharepoint

I have created a Custom Web API using .net C# that will be called in my sharepoint online and i was wondering if is there is anything i could use from sharepoint and use it in my WebApi to verify that ...
0
votes
1answer
260 views

Can I use elevated permissions using JSOM, CSOM, or REST?

I am working with an On-Premise SharePoint 2016 farm and I am looking for some way to elevate permissions, so I don't use the logged-in user's credentials but another set of permissions that the ...
1
vote
1answer
33 views

Hide parts of a Sharepoint Online Site

I have created a very basic SP site in SP Online. I am using modern pages. Basically I have some promoted links (using third party app) that users can click and open up different apps, links, etc. I ...
0
votes
1answer
21 views

User profiles not available in security

I have a SharePoint 2016 on-prem server farm that I manage. It is set up to sync users from Active Directory and everything appears to be working fine. Since there are multiple OUs containing ...
1
vote
1answer
71 views

Is it possible to upload the same file, to multiple document libraries?

Is it possible to quickly upload the same file to multiple document libraries? The reason I want to do this is because I have multiple document libraries because they each have different security ...
0
votes
1answer
41 views

Error in removing SharePoint Solution

I am trying to remove the user solution. I used site.Solutions.Remove(Solution) But I am getting error The security validation for this page is invalid. Click Back in your Web browser, ...
1
vote
0answers
23 views

Where / How is security information passed to SharePoint?

If I execute a query in SharePoint, my security information is passed along with the query. I'm using Developer Tools in I.E.(F12) and am trying to see where this information is passed. Can anyone ...
2
votes
1answer
168 views

Missing 'Strict-Transport-Security' header in sharepoint web application

we have SharePoint site deployed on the internet and when we scan some security settings we found below issue Missing 'Strict-Transport-Security' header Scanner discovered that the affected ...
1
vote
2answers
48 views

SharePoint and OpenPGP file encryption

If I have SharePoint on an azure cloud which can be accessed from any computer using a browser, is it possible to integrate client side PGP encryption so when files are uploaded, they are encrypted ...
3
votes
0answers
219 views

How to get the Data of PWA Settings Security entities? (Using CSOM or REST API)?

I want to get the Groups and Users from PWA settings-> Security tab using CSOM or REST API? How do i get it?
0
votes
1answer
1k views

O365 Security Groups don't appear to be working with SharePoint Online

Today in an effort to clean up our SharePoint permissions and centrally manage things a little more efficiently, we compared our Active Directory groups (OUs) to our groups in SharePoint. I created ...
1
vote
2answers
58 views

SP 2010 Office Web Apps question

I had a quick question. We are in the process of remediation vulnerabilities in our existing SP 2010 environment (Both Windows and SP) There are two updates below that we need to install for SP 2010 ...
2
votes
0answers
187 views

How to prevent Cross Site Scripting attack in sharepoint search

In SharePoint 2013 how to prevent cross-site scripting attack, I deployed a publishing portal to the internet users and its enabled Anonymous access and web application enabled claims mode ...
0
votes
1answer
128 views

SharePoint Web-services disabling automatically causing site down

SharePoint search host controller and SharePoint Server Search 15 disabling every time I enable it. Reason I found that recently I have changed service account password which is used for those two ...
1
vote
0answers
128 views

IRM group access, all users who currently have access on SharePoint

I have found an article whilst looking into applying IRM to SharePoint libraries here: https://docs.microsoft.com/en-us/azure/information-protection/office-apps-services-support Within the article, ...
3
votes
1answer
131 views

Make SharePoint list partly confidential

There is monthly confidential data I want to collect from my firm's subsidiaries through a SharePoint list, directly connected to my workfiles (Excel, Power Bi and related PPT). The existing ...
0
votes
1answer
35 views

Sharepoint security trimming and OneDrive for business

If I have library with 2 folders, and John Smith have access to only one folder - would both be visible for him, if he connects this lib with OneDrive for Business? Does security trimming work in ...
1
vote
0answers
62 views

SharePoint Windows logging - account was successfully logged on 4624 - why so frequent?

My company has a centralized logging platform for all servers. We recently noticed that the bulk of our events come from SharePoint servers for successful logon events. If I look at "Event Viewer" -> "...
0
votes
1answer
696 views

Why are SharePoint security updates failing through Windows update repeatedly, then succeeding?

We have several single-server SharePoint 2013 farms running on Windows 2008 R2. When we do monthly patching through Windows Update, non-SharePoint patches install successfully. However, all SharePoint ...
0
votes
1answer
299 views

SP2010 “NT AUTHORITY\Authenticated Users” group versus the SP2013 “Everyone” group?

In my test SharePoint 2010 instance, I notice SharePoint has a special group called NT AUTHORITY\Authenticated Users In my SharePoint 2013 instance, I notice I have a special group called Everyone ...
2
votes
0answers
148 views

SharePoint Online Access Requests for Users not in Directory

We have a requirement for users not in our O365 tenant to be able to submit an access request to our SharePoint Online site. Normally, if a user in a tenant doesn’t have access to a site, they will ...
1
vote
0answers
30 views

Intended Audience Header/Banner and Security Control

We are currently in SharePoint 2013 on-prem and soon to be in 2016 on-prem (we are not going to SharePoint online yet). Our goal is to provide a clear statement/header/banner of who should have ...
1
vote
2answers
49 views

How can a specific user be allowed to upload a file to a library, but not read that file?

A specific account will upload files from many different machines all over the internet to one folder in a SharePoint library. Content of the files is sensitive in nature, so if a malicious attacker ...
2
votes
2answers
523 views

Can you disable Delve for a particular site?

For example, the board site is making an executive nervous that another board person can see what they are doing in delve.
2
votes
3answers
7k views

How to disable “edit page” for members in Sharepoint?

I want to allow members to edit/create/delete/update list items, but when I allow permissions "edit", the edit page link is accessible to them: I've tried solutions, such as: Break inheritance and ...
2
votes
2answers
39 views

Security Update Application

Microsoft has released a Security Update which applies to SP2010/13/16. Description of the security update for SharePoint Server 2010: January 9, 2018 CVE-2018-0789 | Microsoft SharePoint Elevation ...
1
vote
2answers
273 views

security updates for SP 2013 farm

I am trying to update security updates for SP 2013. I tried to download one security update it has almost 52 items.How can I install these all items in one shot or quickly.Please suggest quickly.
1
vote
3answers
78 views

Boss needs SharePoint site only he can access (so not even administrator can)

I have a good one for ya today. Let me give you a quick backstory so you may understand these needs better. We had an employee who was a system administrator at my current company. Since he was a ...
1
vote
2answers
30 views

same web application there is any way to set farms authentication only to a specific site or site collection without extend or change host name

Hi i configured windos and Farms based authentication for web application,when i login to secured pages it redirect to login page and has options to select windows and farms authentication, but in ...