Wednesday, September 24, 2014

It is SharePoint Permission call FullMask or "NearFullMask" in CSOM?

This Post is about SharePoint JSOM and RESt and how SharePoint deals with FullMask Permission in Client Side Object Mode and what means High and Low Properties in BasePermission Object on SharePoint Object Model.

This topic was first talked and promissed in the following post:
How to Convert REST Call to SharePoint JSOM Object (ECMAScript)

when we configure permission of user permission it is possible to define some type of permissions templates to users or some Web Object like "UserCustomActions", the same way we do with declarative XML.
But when i was making and my SharePoint App "SharePoint App Processlynx Custom Action and Ribbon Manager Launch" and was validating the permission field found out that FullMask is not really FullMask.... here are my findings.

Here are the results about the “BasePermissions” Issue in SharePoint Client Object Model (SP.BasePermissions) and REST:



This are the values of all possible “PermissionKinds” im SCOM (split in two parts – the low and high “PermissionKinds”) :
For the low “PermissionKinds” from 1 to 32:
01: 0000000001: 0000000000000000000000000000001: ViewListItems
02: 0000000002: 0000000000000000000000000000010: AddListItems
03: 0000000004: 0000000000000000000000000000100: EditListItems
04: 0000000008: 0000000000000000000000000001000: DeleteListItems
05: 0000000016: 0000000000000000000000000010000: ApproveItems
06: 0000000032: 0000000000000000000000000100000: OpenItems
07: 0000000064: 0000000000000000000000001000000: ViewVersions
08: 0000000128: 0000000000000000000000010000000: DeleteVersions
09: 0000000256: 0000000000000000000000100000000: CancelCheckout
10: 0000000512: 0000000000000000000001000000000: ManagePersonalViews
12: 0000002048: 0000000000000000000100000000000: ManageLists
13: 0000004096: 0000000000000000001000000000000: ViewFormPages
17: 0000065536: 0000000000000010000000000000000: Open
18: 0000131072: 0000000000000100000000000000000: ViewPages
19: 0000262144: 0000000000001000000000000000000: AddAndCustomizePages
20: 0000524288: 0000000000010000000000000000000: ApplyThemeAndBorder
21: 0001048576: 0000000000100000000000000000000: ApplyStyleSheets
22: 0002097152: 0000000001000000000000000000000: ViewUsageData
23: 0004194304: 0000000010000000000000000000000: CreateSSCSite
24: 0008388608: 0000000100000000000000000000000: ManageSubwebs
25: 0016777216: 0000001000000000000000000000000: CreateGroups
26: 0033554432: 0000010000000000000000000000000: ManagePermissions
27: 0067108864: 0000100000000000000000000000000: BrowseDirectories
28: 0134217728: 0001000000000000000000000000000: BrowseUserInfo
29: 0268435456: 0010000000000000000000000000000: AddDelPrivateWebParts
30: 0536870912: 0100000000000000000000000000000: UpdatePersonalWebParts
31: 1073741824: 1000000000000000000000000000000: ManageWeb
65: 0000065535: 0000000000000001111111111111111: FullMask

And for the high “PermissionKinds” from 33 to 64:
37: 0000000016: 0000000000000000000000000010000: UseClientIntegration
38: 0000000032: 0000000000000000000000000100000: UseRemoteAPIs
39: 0000000064: 0000000000000000000000001000000: ManageAlerts
40: 0000000128: 0000000000000000000000010000000: CreateAlerts
41: 0000000256: 0000000000000000000000100000000: EditMyUserInfo
63: 1073741824: 1000000000000000000000000000000: EnumeratePermissions
65: 0000032767: 0000000000000000111111111111111: FullMask

As you can see the “FullMask” don’t cover all permissions. In the low “PermissionKinds”, the permissions from “Open” to “ManageWeb” and in the high PermissionKinds, the permission “EnumeratePermissions”, are not included.


The “FullMask” should be like this to cover all “PermissionKinds”:
65: 2147483647: 1111111111111111111111111111111: FullMask


To only cover all now available permissions, the “FullMask” could be also like this:
For the low “PermissionKinds”:
65: 2147425279: 1111111111111110001101111111111: FullMask

And for the high “PermissionKinds”:
65: 1073742320: 1000000000000000000000111110000: FullMask


In the (Server) SharePoint Object Model (Not Client) everything is correct:
0000000000000000001: 000000000000000000000000000000000000000000000000000000000000001: ViewListItems
0000000000000000002: 000000000000000000000000000000000000000000000000000000000000010: AddListItems
0000000000000000004: 000000000000000000000000000000000000000000000000000000000000100: EditListItems
0000000000000000008: 000000000000000000000000000000000000000000000000000000000001000: DeleteListItems
0000000000000000016: 000000000000000000000000000000000000000000000000000000000010000: ApproveItems
0000000000000000032: 000000000000000000000000000000000000000000000000000000000100000: OpenItems
0000000000000000064: 000000000000000000000000000000000000000000000000000000001000000: ViewVersions
0000000000000000128: 000000000000000000000000000000000000000000000000000000010000000: DeleteVersions
0000000000000000256: 000000000000000000000000000000000000000000000000000000100000000: CancelCheckout
0000000000000000512: 000000000000000000000000000000000000000000000000000001000000000: ManagePersonalViews
0000000000000002048: 000000000000000000000000000000000000000000000000000100000000000: ManageLists
0000000000000004096: 000000000000000000000000000000000000000000000000001000000000000: ViewFormPages
0000000000000008192: 000000000000000000000000000000000000000000000000010000000000000: AnonymousSearchAccessList
0000000000000065536: 000000000000000000000000000000000000000000000010000000000000000: Open
0000000000000131072: 000000000000000000000000000000000000000000000100000000000000000: ViewPages
0000000000000262144: 000000000000000000000000000000000000000000001000000000000000000: AddAndCustomizePages
0000000000000524288: 000000000000000000000000000000000000000000010000000000000000000: ApplyThemeAndBorder
0000000000001048576: 000000000000000000000000000000000000000000100000000000000000000: ApplyStyleSheets
0000000000002097152: 000000000000000000000000000000000000000001000000000000000000000: ViewUsageData
0000000000004194304: 000000000000000000000000000000000000000010000000000000000000000: CreateSSCSite
0000000000008388608: 000000000000000000000000000000000000000100000000000000000000000: ManageSubwebs
0000000000016777216: 000000000000000000000000000000000000001000000000000000000000000: CreateGroups
0000000000033554432: 000000000000000000000000000000000000010000000000000000000000000: ManagePermissions
0000000000067108864: 000000000000000000000000000000000000100000000000000000000000000: BrowseDirectories
0000000000134217728: 000000000000000000000000000000000001000000000000000000000000000: BrowseUserInfo
0000000000268435456: 000000000000000000000000000000000010000000000000000000000000000: AddDelPrivateWebParts
0000000000536870912: 000000000000000000000000000000000100000000000000000000000000000: UpdatePersonalWebParts
0000000001073741824: 000000000000000000000000000000001000000000000000000000000000000: ManageWeb
0000000002147483648: 000000000000000000000000000000010000000000000000000000000000000: AnonymousSearchAccessWebLists
0000000068719476736: 000000000000000000000000001000000000000000000000000000000000000: UseClientIntegration
0000000137438953472: 000000000000000000000000010000000000000000000000000000000000000: UseRemoteAPIs
0000000274877906944: 000000000000000000000000100000000000000000000000000000000000000: ManageAlerts
0000000549755813888: 000000000000000000000001000000000000000000000000000000000000000: CreateAlerts
0000001099511627776: 000000000000000000000010000000000000000000000000000000000000000: EditMyUserInfo
4611686018427387904: 100000000000000000000000000000000000000000000000000000000000000: EnumeratePermissions
9223372036854775807: 111111111111111111111111111111111111111111111111111111111111111: FullMask

In the “Microsoft.SharePoint.Client.dll”  there is a limitation value in the BasePermission” class:
In the function “Set”:

And in the function “Has”:

So the possible value of “FullMask” must be increased for the high values from 32767 to 2147483647 and for the low values also from 65535 to 2147483647 to cover all permissions or for the high values from 32767 to 1073742320 and for the low values also from 65535 to 2147425279 to cover only the now available permissions.
Only then the “PemisionKind FullMask” will really cover all available permissions.
But maybe Microsoft for security reasons limited this values....

Thanks to my colleague “Selim Gezgin” for collecting all this info about this topic.

Kind regards, 
Andre Lage


Post a Comment