3/11/2009 4:33:31 PM #

Thanks for bringing that up Jonas,

In reality, all you've done is create a specific page (whatever you add in the tag) which can run custom code.  A user must have access to modify this master page, page layout, etc, to put code in the page.

Of course, if you give someone access to a page running server-side code, you've given them access to write bad code.  The same would apply if you've given a developer access to deploy web parts.

An administrator has to be aware of who has access, and shouldn't enable this unless all users that can modify that master page are trusted with writing custom code.

I don't think it's opening any ambiguous security holes.  It's very explicit, you are granting permission to editors of that page to use custom code.

Stefan Keir Gordon |

3/11/2009 4:33:31 PM #

And by doing this you have just compromised the security of your whole SharePoint farm.

Anyone that can modify a web part page can now start writing C# code to do all sorts of things.

For example run with elevated permissions and delete stuff or read data that the user does not have access too.

Don't do it
/Jonas

tojonas |