How to manage column based access control in Sharepoint lists?

Question

I'm making issue tracking portal based on Sharepoint. Users should be able to add entries, but in the entry itself I want one column to only be visible to a specific group of users (Administrators). Is there a way to set column based access control?

Answer 1

As far as I know that is not available in the standard platform. What you can do on the other hand is to handcraft your own fieldcontrol

So in custom fieldtypes.xml

<FieldTypes>

  <FieldType>
    <Field Name="TypeName">MyInteger</Field>
    <Field Name="ParentType">Integer</Field>
    ...
    <Field Name="FieldTypeClass">xxx</Field>
  </FieldType>

and in sitecolumns.xml

  <Field ID="xxx"
      Name="xxx"
      DisplayName="xxx
      Description="xxx"
      Group="xxx
      Type="MyInteger"    
      DisplaceOnUpgrade="TRUE"
  />

and in your fieldcontrol

public class MyInteger: SPFieldNumber
{
    public MyInteger(SPFieldCollection fields, string fieldName)
        : base(fields, fieldName)
    {
    }

    public MyInteger(SPFieldCollection fields, string typeName, string displayName)
        : base(fields, typeName, displayName)
    {
    }


    public override BaseFieldControl FieldRenderingControl
    {
        [SharePointPermission(SecurityAction.LinkDemand, ObjectModel = true)]
        get
        {
            Microsoft.SharePoint.WebControls.BaseFieldControl ctl = 
               new MyIntegerControl();
            ctl.FieldName = InternalName;
            return ctl;

        }
    }

    }

and in the MyIntegerControl you can do whatever you want (lots of overrides), but an example is:

protected override void CreateChildControls()
{
    base.CreateChildControls();
    if (this.ControlMode == SPControlMode.New || 
        this.ControlMode == SPControlMode.Display)
    {
      // check that use is admin and display value
    }
}

Answer 2

You also can do this by register a CustomAction, and change list view schema dynamic

     <CustomAction Id="CustomAction"
          GroupId="SiteActions"
          Location="Microsoft.SharePoint.StandardMenu"
          Sequence="1003"
          ControlAssembly="$SharePoint.Project.AssemblyFullName$"
       ControlClass="CustomAction.ColumnPermissionAction"/>

and in your control class:

class ColumnPermissionAction : Control
{
    protected override void OnLoad(EventArgs e)
    {
        base.OnLoad(e);
        HideColumn();
    }

    private HideColumn(){
         WebPart part=//find your web part
         string colName="SecretColumn";
         if(part is ListViewWebPart){
            (part as ListViewWebPart).ListViewXml = (part as ListViewWebPart).ListViewXml.Replace(string.Format("<FieldRef Name=\"{0}\"/>", colName), string.Empty);
         }else if(part is XsltListViewWebPart){
            PropertyInfo property = typeof(DataFormWebPart).GetProperty("ListViewXmlDom", BindingFlags.NonPublic | BindingFlags.Instance);
            if (property != null)
            {
                XmlNode xmlView = property.GetValue(part as XsltListViewWebPart, null) as XmlNode;
                if (xmlView != null)
                {
                    XmlNode node = xmlView.SelectSingleNode("//ViewFields");
                    if (node != null)
                    {
                            var field = node.SelectSingleNode(string.Format("FieldRef[@Name='{0}']", colName));
                            if (field != null)
                            {
                                node.RemoveChild(field);
                            }
                    }
                }
            }
         }
    }
}