SharePoint Hosted App 2013：自定义List / AllItems.aspx页

Question

I'm trying to implement permission levels in SharePoint hosted app. I've created a custom list "Permissions" where I'm adding different users with their roles.

I have created a page List.aspx where I'm showing my custom list "Products" as a list view web part. Page List.aspx checks the user's role against "Permissions" list, and page can show or hide content in regards to this role. The problem is, when user tries to navigate to "Lists/Products/Allitems.aspx" or "Lists/Permissions/Allitems.aspx" he can see the list items.

All code check is done in JavaScript and I know there is a security risk, but this will work for my users. I just need to find a way to inject custom JavaScript code to Allitems.aspx, and to check if user has permissions to see it or not.

Everything here is done on App web and there's nothing that I use on host web.

Answer 1

I've found a workaround for this. Basically what I did is that I just hide the list view from direct access. To achieve this, open the Schema.xml of the list and replace "JSLink":

from

<JSLink>clienttemplates.js</JSLink>

to

<JSLink>~site/Scripts/OverrideListView.js</JSLink>

Now, create a new file Scripts/OverrideListView.js and add following code to it:

document.write("<style>body {display:none; };</style>");

Try now to access Lists/Permissions/Allitems.aspx directly. You will get a blank page.

This is basically idea how to insert custom JS code into list view. You could add additional code for checking current user's permissions on site level and in regards to it to unhide this view, or even to redirect him to the homepage if he does not have right role or permissions.