SharePoint 2010 : Securing Information - Securing Lists

1. Content Approval

Content Approval is an advanced setting that prevents a new item in a list from appearing until the item has been approved by a user with approval rights. This setting must be enabled if you plan to use approval workflows that can be initiated with the publication of a minor version to a major version. Even in lists or libraries in which versioning is turned off, new items will still need to be approved before users with Read-Only permissions can view the content item. Figure 1 illustrates a document in a Pending state that has been uploaded to a library with Content Approval enabled.

When the Content Approval feature is enabled, existing content items will be approved automatically. If Major/Minor versioning is also enabled, then the last major version will automatically be approved. Any existing documents that are checked out will automatically show as being Approved, but when they are checked in, they will go into a Pending state until the check-in action is approved.

The easiest way to approve a document is to click the drop-down arrow for the document and select the Approve/Reject menu item, then select the Approved option (Figure 2). Another way you can approve a document is to highlight it in the library and then click the Approve/Reject Ribbon icon in the Workflows section. If you need to see a list of all the documents or list items that need approval, click the Library tab in the Ribbon (for document libraries; for lists, click the List tab) and then, under Current View, select the drop-down arrow and select the Approve/Reject Items menu option. Figure 3 illustrates what the content approval list looks like when there are one or more items in the list.

Note:

Items that are in the Pending state can still be viewed by users who have permissions if they have the exact URL to the content item. The Content Approval feature, is not a security feature by itself. Instead, like audiences, it is a view-crafting feature, but unlike audiences, it helps support approval workflows and the publishing of content items.

2. Versioning Settings

There are three types of version settings in SharePoint 2010: None, Major Only, and Major/Minor. When no versioning is selected, each time a content item is updated or uploaded into the list, it is immediately available for viewing by everyone who has at least View permissions to the list. Moreover, no version history is saved, so the only version of the content item is the current version. Because past versions are not saved, they cannot be retrieved.

Major Only versioning creates published versions each time a content item is updated or uploaded to a list or library. The main difference between no versioning and Major Only is that past versions of the content item are retained in their full-text form. But new versions are still immediately viewable and consumable by those with proper permissions.

Major/Minor versioning was first introduced in Microsoft SharePoint Portal Server 2001. It was taken out of Microsoft SharePoint 2003 and was put back into the SharePoint Server 2007 product; it has been retained in SharePoint 2010. Major/Minor versioning (M/M) allows for the development of a document or list item by a small team of content developers who then periodically publish updated versions of the document for a wider audience to consume. The versioning numbers will inform you which version of the document that you are working with. M/M versioning works with a two-numeral decimal system in which the number to the right of the decimal is the minor version and the number to the left of the decimal is the major version. For example, the version designation 0.2 means that you are on the second draft or minor version but have yet to publish a major version. The version designation 1.0 means that you have published your first major version of the document. The version designation 3.3 means that you have published three major versions, the third version is the current “public” version, and you are currently working on the third minor version, which you are using to create the fourth major version, which will be published for public consumption as 4.0.

Each time a document is published, the major versioning number will increment by one (1) and the minor version number will be reset to zero (0). Each time a minor version is checked in, the minor version number will increment by one (1), and the major version number will not increment or decrement.

The reason that M/M versioning can be viewed as a security feature is that currently published documents can continue to be viewed while updates to those documents are created in a secure, private way. You will want to use M/M versioning for documents that have public content that is updated periodically, such as a human resource policy manual, but for which you also want to hide the draft updates of those documents from public consumption.

3. Draft Item Security

Draft item security is only relevant when you have Major/Minor versioning enabled. Draft items are the same thing as minor versions and apply to all new documents created or uploaded into the library. Changing draft item security settings will not apply to those documents that already exist in the library.

The three settings for draft item security are

• Any User Who Can Read Items

• Only Users Who Can Read Items

• Only Users Who Can Approve Items (and the authors of those items)