Blog Site in Anonymous Use

By Juha AlhojokiDecember 22 2010 57 comments

Anonymous user cannot enter a blog entry in a SharePoint site if ViewFormPagesLockDown feature is active at site collection level and ViewFormPagesLockDown feature is active if site collection is based on publishing portal. After googling we came accross plenty of resources considering this matter:

We didn’t want use the solutions suggested in the links above. To disable the ViewFormPagesLockDown “…leaves you wide open from a security perspective…”. To have our blog site in another site collection. Well that’s just not what we want to do to solve this tiny little thing with permissions.

Me and Aapo dug with reflector into ViewFormPagesLockDown feature and found out what the feature receiver does.

The highlighted sections of the feature receiver show what happens to Guest’s permissions at rootweb level when you disable ViewFormPagesLockDown site collection level feature.

So why not just take the solution from where it is and develop a web scoped feature which does the exactly same thing to the blog site but not to all webs in the site collection because that’s not what we want.

Develop a feature receiver as follows:

using System;
using Microsoft.SharePoint;

namespace My.Assembly
{
    public class FormPagesLockDownReleaseReceiver : SPFeatureReceiver
    {
        public override void FeatureActivated(SPFeatureReceiverProperties
        properties)
        {
            using (var web = (SPWeb)properties.Feature.Parent)
            {
                var anonymousState = web.AnonymousState;
                // continue only if anonymous use is enabled
                if (anonymousState == SPWeb.WebAnonymousState.Disabled)
                    return;
                web.AllowUnsafeUpdates = true;
                 // break inheritance to set permissions per site
                web.RoleDefinitions.BreakInheritance(true, true);
                // permission granting from LockDownViewFormPages
                var byType = web.RoleDefinitions.GetByType(SPRoleType.Guest);
                byType.BasePermissions |= SPBasePermissions.EmptyMask |
                SPBasePermissions.ViewFormPages;
                byType.BasePermissions |= SPBasePermissions.UseRemoteAPIs;
                byType.Update();
                // reset the anonymous state programmatically
                web.AnonymousState = SPWeb.WebAnonymousState.Disabled;
                web.AnonymousState = anonymousState;
                web.Update();
                web.AllowUnsafeUpdates = false;
            }
        }
    }
}

Resetting the anonymous state is just a thing you would have to do from UI when you toggle permissions. Lockdown Mode in SharePoint 2010: “If anonymous is already setup, you may need to disable\re-enable anonymous on the site.”

Then a web scoped feature that consumes the receiver:

<?xml version="1.0" encoding="utf-8" ?>
<Feature  
  Id="{6189C7B4-6FDC-4BAA-95FD-03DD318031E5}"
  Title="Blog Anonymous Access Staplee"
  Description="Enables Anonymous Access to Blog Entries"
  Scope="Web"
  ReceiverAssembly="My.Assembly,
  Version=1.0.0.0,
  Culture=neutral,
  PublicKeyToken=e3e48257ada349c4"
  ReceiverClass="My.Assembly.FormPagesLockDownReleaseReceiver"
  Hidden="FALSE"
  xmlns="http://schemas.microsoft.com/sharepoint/">
</Feature>

You could set the feature hidden to avoid accidental feature activations.

Then a stapling mechanism at site collection level to staple the feature to Blog sites by default.

Stapling.xml

<?xml version="1.0" encoding="utf-8" ?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <!--BLOG#0-->
      <!--Staple FormPagesLockDownReleaseReceiver to Blog sites -->
      <FeatureSiteTemplateAssociation
    Id="6189C7B4-6FDC-4BAA-95FD-03DD318031E5"
    TemplateName="BLOG#0" />
</Elements>
<?xml version="1.0" encoding="utf-8" ?>
<Feature
    Id="{7DF309A4-7E3B-488A-9D2A-F3B88D656465}"
    Title="Blog Anonymous Enabling Stapler"
    Description="Staples Anonymous Access to Created Blog Sites"
    Version="1.0.0.0"
    Scope="Site"
    xmlns="http://schemas.microsoft.com/sharepoint/"
    ActivateOnDefault="FALSE">
    <ElementManifests>
        <ElementManifest Location="Stapling.xml" />
    </ElementManifests>
</Feature>

Voila, you have a mechanism to allow viewing form pages only in blog sites when you activate the stapler feature at site collection level. Of course, if you want, you could even set the needed permissions at list level in the Blog site, I suppose, but that’s not what we’ve done here.

Popularity: 4% [?]

, ,

57 comments to “Blog Site in Anonymous Use”

« Older Comments
  1. Anne says:
    August 2, 2021 at 03:26

    Great content, excellent! towing service

  2. James A says:
    August 5, 2021 at 08:39

    I went through this website and found it very impressive. Keep sharing. Middle River Tow Truck

  3. Calum S says:
    August 11, 2021 at 07:45

    Well written content. Thank you for sharing. tow truck

  4. Katy says:
    August 12, 2021 at 07:47

    Interesting piece, thanks for sharing! tow truck

  5. Andrew says:
    August 13, 2021 at 08:22

    Well done on this post towing service

  6. Taylor says:
    August 13, 2021 at 09:07

    This is an interesting article. tow truck

  7. mshahid says:
    August 16, 2021 at 09:39

    You might comment on the order system of the blog. You should chat it’s splendid. Your blog audit would be swell up your visitors. I was very pleased to find this site. Scott Dietrich Gainesville VA

« Older Comments

Leave a Reply

«
»