Questions tagged [security]
Security is the protection of information and property from theft.
620
questions
0
votes
0
answers
21
views
How to know if I can trust an SPFX webpart?
I am in the process of implementing an spfx webpart but before I need to make sure it is not a security threat.
From researching I was not able to find if there is any way to run a check or provide a ...
- 1
0
votes
0
answers
16
views
Cannot open Office documents - repeating log in window
we use SharePoint 2019 on-premise and Office 365. Sometimes some users have problem when they open Word or Excel, it opens Windows Security window and after log in,it is repeatly opening. I know, that ...
- 149
0
votes
0
answers
11
views
Allow editing in iframe using shared link of files hosted in SharePoint
I have a requirement for a project where I am expected to create an editable share link for files hosted in SharePoint and then embed them in my web application. The point is that user should be able ...
0
votes
1
answer
11
views
One user and one guest in Office 365 but Sharepoint lists 6 users
A client of mine subscribes Office 365. He is the only full user, and there is only one guest user that has access to some shared folders in One Drive. However, when he goes to SharePoint>Manage ...
0
votes
1
answer
233
views
It is fine if we store the Chat GPT api key inside the SPFx web part properties
I want to embed a chat GPT inside our SharePoint and i found this web part @ https://github.com/pnp/sp-dev-fx-webparts/tree/main/samples/react-chat-gpt .but the issue is that it stores the Chat GPT ...
0
votes
1
answer
43
views
Secure the SharePoint lists from allowing Project Manager to add users inside a Projects the PM is not defined inside it
We are in the Design phase of a Project Management system, and we have 2 technical approaches to follow:-
SharePoint as the Back-end + Power Apps & Power Automate
SQL server as the Back-end + ...
0
votes
2
answers
60
views
How secure is SharePoint Server 2019 compared to 2016
I'm actually in a small battle to propose SharePoint 2019 to my company. They want to go to 2016 as migration from 2013 will be "faster" (skipping the upgrade hop).
I know that I can make ...
- 303
0
votes
1
answer
18
views
Sharepoint Security Question Deletion
How to allow a top-level user to delete items but not folders, or columns?
How to go around with this?
1
vote
0
answers
342
views
How to secure the 2-stage approval application using SharePoint & Power Apps & Power Automate
We have a travel request application. where a user submit a request where it should go into 2 stages of approval process before it gets Final Approval.
Now we did the following:-
Create a SharePoint ...
0
votes
1
answer
508
views
Is there any security issue in using dangerouslySetInnerHTML to render HTML Code inside our React.js sharepoint modern web-part
I am trying to build a React JS SharePoint modern web part, which have the following capabilities:
Inside the Web Part settings page >> there are 2 fields named as "Who We Are" & &...
0
votes
1
answer
52
views
Permissions tab is disabled for the owner
I am the owner of an SP online site and the permissions tab has been disabled for me.
Url of the above page is:
https://Tenant.sharepoint.com/sites/SiteName/_layouts/15/user.aspx?obj=%7BIDDDDDD%7D,...
- 425
0
votes
0
answers
196
views
Can I have dynamic, group-based item-level security on a SharePoint list?
In SharePoint online lists I know how to have all list items visible to all users with permission on the list. I also know how to have items visible only to the user who created the item, or to users ...
- 126
1
vote
1
answer
115
views
SharePoint IP Address Restrictions on Anonymous sharing
My goal is to restrict access on my web excel documents from outside my organization.
This works fine on all my OneDrive files except the ones I'm sharing anonymously.
For example I have a document on ...
0
votes
1
answer
76
views
Restrict content access based on intranet/Internet access
Hi Expert Sharepoint architectures,
Our IT director is inquiring about if it's possible to limit the content access based on the network access (intranet or Internet)? For example, user has full/...
- 129
1
vote
2
answers
1k
views
How to restrict access to file based on metadata?
I'm looking for a way to restrict access to certain types of records based on their metadata. Basically there are some types of files that all employees in a team should see, and some they shouldn't (...
- 23
0
votes
3
answers
429
views
How we can secure the ClientID & ClientSecret inside our remote event receivers (Inside SharePoint Provider hosted app)
I have developed many remote event receivers and host them inside azure web apps. now the web.config file inside those remote event receivers contain the ClientId & ClientSecret, as follow:-
<...
1
vote
0
answers
69
views
Auditing PowerShell Activity
I can see changes made to SharePoint Online using the available audit logs etc. But I don't see PowerShell activity by admins or others. Most like a person who is going to hack the platform is going ...
- 2,197
0
votes
2
answers
273
views
Notification for When External Users Join
We have a few sites that require external access at the folder level. The external user has to be in Active Directory before adding to folder permissions so we created a new group 'External Users' and ...
- 3,895
1
vote
1
answer
115
views
SharePoint 2019 Security group AD group
There are few security groups in my SharePoint site .AD groups are added to the security groups. Is there any way using REST API to find out that the current user belongs to which all security groups ....
- 21
0
votes
1
answer
187
views
How to restrict the server login Prompt and redirect to home page of application
I have one internet publishing SharePoint Site. How to restrict the server login Prompt and redirect to home page of application
For example i have my site:
https://*****/products/pages/default.aspx
...
- 147
0
votes
1
answer
493
views
Restrict to _vti_bin folder in all subsites for external SharePoint Sites
Hi as per company security compliance anonymous users should not access _vti_bin folder and services inside this folder.
we have an external SharePoint site accessible for anonymous users.
if I ...
- 147
0
votes
1
answer
2k
views
If we Disable TLS 1.0,TLS 1.1 and Enable only TLS 1.2 Support in SharePoint 2013 Servers?
Hi according to our security policies if we disable TLS 1.0,1.1 and enable only TLS 1.2 in SharePoint servers is there any impact to SharePoint Farm and its Services.
TLS 1.2 will support in ...
- 147
0
votes
1
answer
21
views
mandatory tests with SPO/Forms
is there a way to create a mandatory security training with SPO/Forms?
All users should be forced to go through a regular IT security training with a short test at the end. Is there a way/policy to ...
0
votes
1
answer
27
views
How can I set up my site so it works like a post-box?
Hard to explain in one line, so full analogy:
You go to the post box to send a paper letter. 30 other people do the same. I can put my letter in, but I can't get other people's letters out. Moreover, ...
- 111
0
votes
1
answer
67
views
Can you set the permissions for a user when you share an SP site with them (as a member)?
Scenario:
I create a new team site (without O365 group) from the Admin center. I added a few users to the Member group so they have edit permissions on the site.
Current behaviour:
These members are ...
- 107
0
votes
1
answer
322
views
SharePoint 2013 Public site how to test SQL Injection attacks vulnerability
Hi In SharePoint 2013 Public site how to test SQL Injection attacks ? In SharePoint 2013 web application i deployed some custom web parts,displaying data from custom lists to pages etc
- 147
0
votes
1
answer
309
views
Which security patches should i install every month for SharePoint 2013
In SharePoint 2013 which security patches should i install every month and i don't want to install all Cumulative updates every month because of size also one reason.
like for example Aug 2020
https://...
- 147
0
votes
1
answer
15
views
How to grant access to all site data but disallow list modifications
I'm creating a SPO site that will serve as the backend for a PowerApp. Several lists will have item level permissions so that only users who created the data will be able to view it. The app will have ...
- 103
0
votes
2
answers
30
views
How to apply security patch in SharePoint 2010 without upgrading to cumulative update?
Microsoft releases security bulletin every month which also include SharePoint vulnerabilities.
We have many sites running on my SharePoint 2010 instance, and if we apply cumulative update according ...
0
votes
1
answer
1k
views
How to mask a field like SSN or ID field?
Is there way to mask a field like social security number or ID field? I like mask field both in list view level, edit form and view form. Is it possible?
Sharepoint 2013 (we have nintex form as well)
- 17
0
votes
1
answer
79
views
Can't Create Session
I am trying to update a custom authentication page from SharePoint 2010 to 2013. It basically takes credentials from a CAC card and creates them a user account in FBA if they didn't already have one ...
- 174
0
votes
1
answer
508
views
How to stop malicious files (XSS files) upload even for admin users who have full permissions to site collection
Hi In SharePoint how to stop malicious files (XSS files) upload even for admin users who have full permissions to site collection.
For example, in a custom list or document library, no one can upload ...
- 2,955
0
votes
1
answer
70
views
Can O365 Security and Compliance Alert Policies be limited to a single document library?
I've been trying to use the Alert Policies in the Office 365 Security and Compliance center to build an alert policy for a single high security document library. I want to get an alert for when people ...
- 219
1
vote
3
answers
243
views
Sharepoint online item level permissions
I have a document library in which I have a folder called sharepoint and with in that folder it has some important data.
Now I want to access the above folder and it content only to a specific group.
...
0
votes
1
answer
634
views
CSS was ignored due to mime type mismatch
I am working on client side web part using JavaScript and CSS for customization.
I have added custom css and JS into the page and I am getting the message on console of the browser i.e.
CSS was ...
- 3,230
1
vote
1
answer
87
views
Principle of least privilege on Office 365 OneDrive for Business
Does anyone know how to implement the principle of least privilege on OneDrive for Business on an Office 365 tenant?
I would like to have a way for an automated process to be able to only upload to a ...
- 133
1
vote
1
answer
304
views
Set default or Global Site Collection permissions in SharePoint Online
In SharePoint Server on-prem, we had WebApplication-level permission policies that could allow the administrator to setup certain users or groups to have a set of permissions on All site collections ...
- 3,714
0
votes
1
answer
68
views
Site Permissions Flyout Menu
I'm curious why site permissions load on some sites and not others. This particular one doesn't show anybody but on another site, it shows Owners, Members and Visitor group memberships
- 3,895
0
votes
1
answer
325
views
SharePoint Online Site inherit security group from hubsite
Is there a PowerShell script/cmdlet (pnp/spo) to inherit securitysettings from hubsite?
All sites linked to hubsite https://tenant.sharepoint.com/sites/marketing should have the same permission ...
- 87
0
votes
1
answer
714
views
How to remove RoleAssignments from SPListItem/SPFolder correctly in SharePoint
In the library, I have ParentFolder which contains SubFolder. I have broken role inheritance in both ParentFolder and SubFolder (via a web interface).
But when I remove role assignment for the user ...
- 1
0
votes
1
answer
303
views
Custom web part unable to call custom web API
I'm unable to get my custom web part to connect to my custom Web API.
Ultimately, my goal is to secure the API using Azure AD and then call that API from my web part.
In the local workbench, I'm ...
- 141
1
vote
1
answer
669
views
Why http PUT can upload file successfully to SharePoint?
We are using SP2016 on-premise. In order to handle security test I prepared a PowerShell script to test upload with PUT/POST.
$Digest = $response.getcontextwebinformation.FormDigestValue
$headers = ...
- 4,070
0
votes
0
answers
467
views
FormDigest control problems after September 10, 2019 Security Update
I've noticed some weird behaviour of Microsoft.SharePoint.WebControls.FormDigest control after last security update.
Control is added to every page by setting following code in masterpage:
<asp:...
0
votes
1
answer
31
views
SharePoint 2016 Online Information List out of sync
Help!
I'm adding users to SP Security Groups but they aren't updating on the Information List so users keep getting the Request Access page when then click on a link.
First and most important how ...
3
votes
1
answer
663
views
What exactly "manage trust" in CA is doing? (on-premise)
I have experience on setting up SP2010, 2013 and 2016. In order to install SSL cert and to support https to browse SharePoint, beside install the cert in IIS, usually we need to import the certificate ...
- 4,070
0
votes
2
answers
358
views
Sharepoint 2013 limited access
quick question - we have a bunch of libraries from A to Z with broken permissions and dedicated SP groups to them only. The only issue we've got is with one particular library - all the other groups ...
- 1
2
votes
2
answers
128
views
When opening a file, a warning 'insecure or coming from untrusted source' appears
I inherited SharePoint without knowing anything about it and it crashed hard a few weeks ago but we were able to restore most functionality and this is the only thing that is left. When I open any ...
- 21
2
votes
0
answers
188
views
Excessive Vulnerability Count in Yeoman SharePoint Generator
When I run
yo @microsoft/sharepoint
and pick standard options for a SharePoint Online WebPart with No JavaScript framework, NPM shows 1956 vulnerabilities with 140 of them being high priority.
I ...
- 121
0
votes
1
answer
42
views
Allow files to be shared, with a label
Label within AIP/ARM can be used to restrict sharing with external users. But is there a way to do the opposite?
So I would like to allow users to share specific files when a certain label is added. ...
- 87
0
votes
1
answer
14
views
setting up and limiting access to specific fields in a record
We have 3 different groups of people who are adding data to a table or group of tables. We need to restrict viewing of the data at the field level for 2 groups of people. We also have a need to ...
- 1