The title of this blog post is referring to this screen in the List Settings:
It interests me because it
- allows you to control ownership of the item
- is only available to Lists but not to Document Libraries
- doesn't use unique permissions but some other mechanism
One thing it mentions is that it only works for users without Manage Lists permission on the list. So even if I manage to unravel its' secrets it isn't a waterproof solution (compared to unique item permissions for example). Still, if SharePoint has the notion of ownership it is definitely worth a closer look ! Maybe there's an opportunity here ?
It definitely isn't security by obscurity; if I navigate directly to an item that's not mine I still can't access it.
Peeking under the hood reveals that this setting is stored in SPList.ReadSecurity and SPList.WriteSecurity. Those MSDN articles contain all the details so I'll try not to be repetitive
ReadSecurity
Possible values:
-
1 - All users have Read access to all items.
-
2 - Users have Read access only to items that they create.
WriteSecurity
Possible values:
-
1 — All users can modify all items.
-
2 — Users can modify only items that they create.
-
4 — Users cannot modify any list item.
What about Document Libraries ?
For a Document Library these properties always have a value of "1" meaning everyone has read and write access (provided their permission level is sufficient). Since there is no interface in the Library Settings they cannot be changed. However nothing is stopping me from writing a few lines of code to update the settings, is there ?
using (SPSite site = new SPSite("http://moss/demo1"))
{
using (SPWeb web = site.OpenWeb())
{
SPList list = web.Lists["Shared Documents"];
list.ReadSecurity = 2;
list.WriteSecurity = 2;
list.Update();
}
}
Guess what ? It worked fine in the standard SharePoint Views and queries but not for WebDAV (Explorer View, etc). Probably the reason they only use it on SharePoint Lists.
An opportunity ? Not really since it doesn't act as real security in all scenario's. At least my curiosity is satisfied.