Sharepoint Security issue in _layouts/user.aspx

Question

Considering the following scenario : - create a SharePoint site collection - create a new security permission level "Test", with "Manage permissions" checked. - create a new Group, with "Contribute", and "Test" checked for its permissions.

Now, if a member of this group goes to "_layouts/user.aspx", he can modify his group permissions, and check "Full Control". Now he is site admin.

Is there a way to prevent this behaviour ?

Answer 1

You can use a SPSecurityTrimmedControl to prevent displaying the group list to anyone but Administrators, but as it is a page located in _layouts, it can be overwritten by a service pack, so I think it is not best practice.

Answer 2

I assume you mean "Manage Permissions"? So as far as I can tell, there is no permission for "Let people manage the permissions of others but not be able to give anyone higher permission than they have"... "Manage Permissions" is effectively "Full Control".

SPSecurityTrimmedControl won't really help because it just changes what the user can see, not what they can do. They could still use webservices or the API to manage permissions.