Skip to main content

Security Trimming and REST

Security trimming is an important feature in SharePoint. The permissions defined in a site is "respected" throughout the site including the APIs. So once you define a permission, wherever you navigate, the permissions are applied and accordingly you will (not) see the data.

What does it also mean that if you are using REST API to fetch data from a SharePoint site, the API returns data with security trimmed. So you don't have to apply any additional filter to the query. The same query might return 10 items for one user, 20 items for another user based on the user's permission on items.

Also, let us say, you are trying to get a list of Apps (Libraries and Lists) from a site using REST and you are displaying that on a page. Also assume that you have not given permission to 5 out of 10 Apps to the user "User A".

How many Apps User A get to see in a page? It's not 5 but all. Remember, this is similar to the case where user navigate to Site Contents page and user can see the complete list of Apps regardless of having permission to an App or not. Only when user clicks on an App where user does not have access, it shows Access Denied message.

So even in this case REST works as expected. Hope this will clear any doubts around security trimming in REST API.

Comments

Popular posts from this blog

All about SharePoint List View Styles

Sometimes, there are out of the box features which we tend to ignore and later when we do apply, we are more than happy about the feature which is readily available in SharePoint. One such feature is List View Style. I never thought I would write a post on this. However, whenever I spoke about this with users, people were excited to see the result. That prompted me to write this post.

Instead of getting into only theory part, I will basically take use cases where these styles can be applied and also touch up on on some minor limitations with certain style.

When you are creating/modifying a List view, you will get an option to select View Style. As shown below, there are 8 options available and Default is always set if you ignore this style.


I will take typical Contact List and Announcement List to explian about these styles. Let us go one by one.

Default:
This view, as name suggest, is the default style in a view. This is one of the widely seen style in SharePoint site. This is how it…

How to update Person field with multiple values using REST API

Person or Group field in SharePoint is similar to a Lookup field. When you are updating this field using REST API, you need to append "Id" to the name of the column in the body construct. For example, the body construct looks like this:

data: { "__metadata": { "type": "SP.Data.ListNameListItem" }, "Title": "First Item", "PeopleFieldId": "4" };

The highlighted portions should be replaced by the actual List Name and Column Name. In the above example, the REST call is updating a List item with Title and People columns.

How to get the value for user ID ("4" in the above example) needs a separate explanation and that will be my next post!

The above example works fine if Person field is configured to accept only one value. If we change the Person field to accept multiple values, how do we pass more than one value in the REST call? Since we normally separate user names with semicolon in people picker, I…

How to set character limit for Multiple Lines of Text column in List

Setting a character limit for Multiple lines of text column in a List is not straight forward. Depending upon the setting of the column, the solution varies.

Plain Text:
When you create Multiple lines of text column with "Plain Text", SharePoint renders this field as "TextArea" HTML element. You can set the character limit by making use of maxlength attribute of TextArea element.

$( document ).ready(function(){

    $("textarea[id*=FieldName]").attr('maxlength','1000');

});

The above script should be injected into NewForm.aspx and EditForm.aspx of SharePoint List. Of course, replace "FieldName" with your field name.

Enhanced Rich Text:
When you create Multiple lines of text column with Enhanced Rich Text, SharePoint renders this field as DIV with contenteditable attribute set. This is where it gets more tricky. If you closely observe, the IDs of the contenteditable DIV and the corresponding Label DIV are somewhat similar.

For this DIV,…