如何防止一组用户看到具有特定状态的项目？

Question

Here's my situation ;

On a SharePoint 2010 site, I have a workflow which gives a status " In Progress " or " Completed " to the items.

I'd like to prevent a group of people (for example : site-limited-users) from seeing all the items that have " In Progress " status.

Thank you in advance for your help !

Best regards, Amine.

Answer 1

You may have several options besides messing with item-level permissions.

Using Draft-Level Security

Curiously, your requirements sound almost identical to a built-in feature in SharePoint.

If you navigate to List Settings -> Versioning Settings, you'll see that if you enable major and minor versioning, you get the option to enable Draft Item Security. Draft Item Security allows you to hide minor versions of items from users who don't have sufficient access.

By default, anyone with read access can view draft versions, but you can change it so only people with edit access can view them, or so that only people with more elevated permission level of approve can view them.

You'd just need to make sure that your workflow publishes a major version of the item when it completes.

You might want to explore the content approval option as well; out of the box approval workflows can tap into that feature to control item draft state.

Using Views to Conceal In-Progress Items

Depending on how stringent your security requirements are, you may be able to use views to prevent users from seeing the in-progress items. This would certainly be easier to manage than breaking and resetting permission inheritance at the item-level.

To prevent users from seeing in-progress items:

1. Edit all the public views of the list so that they filter out any in-progress items.
2. Ensure that the restricted group of users does not have access to create any new public or personal views on the list in question.
3. To allow other users to see the in-progress items, add a list view web part to a page and edit the view in that web part so that it does not exclude the in-progress items. Use page-level security or web part audience targeting to prevent the restricted group of users from being able to view the page or web part.

This achieves security by obscurity, removing any direct links by which the users could find their way to the in-progress list items.

It does not provide true security. The restricted users could, for example, directly manipulate the URL to try to find their way to in-progress items, such as by opening up the display form of a completed item and swapping out different values for the ID parameter in the URL query string.