SharePoint Permissions Based Content

One of the challenges I always seemed to face with SharePoint was limiting content displayed based on a users access level. Marc Anderson’s (@sympmarc) SPServices library solves some of those hurdles if you’re using jQuery elsewhere, as you can call the SharePoint permissions web services to determine if a user is in a specific group, then use jQuery to write content. But what if you’re not using jQuery anywhere else, is it worth adding the jQuery library and the related web service calls to check permissions? Are you looking at hiding web parts by permissions, or changing site controls?

I recently discovered the PermissionsString attribute, which compares the user’s credentials against the defined permission string. We can then use this logic to display content relevant to the user’s permissions. This is a great alternative to calling a web service if you’re not already using the jQuery library elsewhere, or if you want to make site wide access based adjustments to the SharePoint UI. As an example, we can hide the “View all site content” link from anyone except for site admins.

Original:

<Sharepoint:SPSecurityTrimmedControl runat="server" PermissionsString="ViewFormPages">
<div class="ms-quicklaunchheader"><SharePoint:SPLinkButton id="idNavLinkViewAll" runat="server" NavigateUrl="~site/_layouts/viewlsts.aspx" Text="<%$Resources:wss,quiklnch_allcontent%>" AccessKey="<%$Resources:wss,quiklnch_allcontent_AK%>"/></div>
</SharePoint:SPSecurityTrimmedControl>

Edited:

<Sharepoint:SPSecurityTrimmedControl runat="server" PermissionsString="ManageWeb">
<div class="ms-quicklaunchheader"><SharePoint:SPLinkButton id="idNavLinkViewAll" runat="server" NavigateUrl="~site/_layouts/viewlsts.aspx" Text="<%$Resources:wss,quiklnch_allcontent%>" AccessKey="<%$Resources:wss,quiklnch_allcontent_AK%>"/></div>
</SharePoint:SPSecurityTrimmedControl>

We can take this a step further, and specify multiple permission string values separated by a comma, which will do an “or” comparison and return the content if the user has any of the defined strings. For those of you working with the web service option which uses enumerated values of the permission strings, I’ve included a cross reference chart below.