SharePoint Permissions: User with Contribute change cannot change a list item they did not create?

I've build a custom SharePoint list that programatically adjusts permissions per list item. This part of the app works by clearing all permissions in the list item and adding permissions to the folks I want to grant Read or Contribute permission to. I believe this part of the application to be correct: selecting Manage Permissions on a list item I can see the appropriate users and roles for the list items in question in the Permissions list.

However, I was surprised to realize that only the user who submitted a list item can successfully edit the item. I'll describe what I'm seeing with the following two users: UserA and UserB. UserA submitted the list item. UserB is trying to edit the same list item after the permissions have been assigned (either manually or programatically).

UserB cannot edit the list item:

UserB can see the Edit Item link on the item toolbar.
UserB can click the link and will see EditForm.aspx.
When UserB makes changes and presses submit, UserB encounters the out of box SharePoint "Access Denied" error page.
The event handler for the list item update does not fire.
Manually elevating UserB's permission to include Full Control does not affect the behavior above.

By contrast, UserA encounters far more predictable behavior:

UserA can see the Edit Item link on the item toolbar.
UserA can click the link and will see EditForm.aspx.
When UserA submits, the changes are persisted and the user is redirected back to the item list.
Event Handlers fire after UserA submits.

This leaves me with several questions:

Is this an expected behavior for SharePoint that I managed to overlook?
What can I do to allow UserB to modify the list item?

Great catch! I'd forgotten about that setting.Is there a way to set this setting in an event handler stapled to the Feature or in the custom list definition?

antik 2010-06-22 16:34:01

Good! on the custom list definition this is controlled by the SecurityBits for more info see here http://msdn.microsoft.com/en-us/library/dd587243(office.11).aspxand for doing this programmatically you need to set the ReadSecurity property and the WriteSecurity (see this for Read http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.readsecurity.aspx and this one for write http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splist.writesecurity.aspx) Hope this helps!

Renzo 2010-06-23 10:42:26

ansaurus

tags:

views:

answers:

SharePoint Permissions: User with Contribute change cannot change a list item they did not create?

related questions