Tips to resolve issue that site owners are able to delete site templates or sandbox solutions before 2011 Dec. CU

If you are using sandbox solution you might be aware of that on SharePoint RTM version, site owners are able to delete site templates or sandbox solutions from solution gallery without deactivating them on load balanced multiple tier environment through edit item as we described before.

This issue supposed to be resolved in 2011 Dec. CU. After we applied 2012 Feb. CU, this issue indeed has been resolved on any new created site collections. Even though the delete option is still available in the ribbon, when site owners try to delete site templates or sandbox solutions from solution gallery without deactivating it, there will be an error message. 

However, this issue is still on the existing site collections created previous the CU. We finally identified the root cause and the way to fix it.

The root cause is the existing the sites created before Feb CU are missing two event receivers on Site Collection “Solution Gallery” list. The two missing event receivers are ItemUpdating and ItemDeleting. You could use the following powershell command to list the event receivers on the Site Collection “Solution Gallery” list for the site collection.

$web = get-spweb http://AffectedSiteName

$sg = $web.lists[“Solution Gallery”]

$sg.eventReceivers | out-file c:\ev.txt

The result for the site collection created after Feb CU has listed below. Please note the two highlighted receivers in RED that are missing on site collection created before the CU.

Id                              : c655b849-6f3f-4d95-a476-ef805a43f13c
Name                        :
SiteId                        : 59682d29-9241-468c-8d73-93b6e74c7a45
WebId                       : 8e1c6b34-9434-4c4d-9ca7-b057f0fd5983
HostId                       : 40187fd3-0178-46f7-b89e-233b7e83a739
HostType                  : List
ParentHostId            : 00000000-0000-0000-0000-000000000000
ParentHostType        : Site
Synchronization        : Synchronous
Type                          : ItemAdding
SequenceNumber      : 10000
Assembly                   : Microsoft.Office.Access.Server.Application, Version=14.0.0.0, Culture=neutral, PublicKeyT          oken=71e9bce111e9429c
Class                          : Microsoft.Office.Access.Server.Template.SolutionGalleryEventReceiver
Data                           :
Filter                          :
Credential                  : 0
ContextItemId           : 0
ContextItemUrl         :
ContextType              : 00000000-0000-0000-0000-000000000000
ContextEventType     : 00000000-0000-0000-0000-000000000000
ContextId                   : 00000000-0000-0000-0000-000000000000
ContextObjectId        : 00000000-0000-0000-0000-000000000000
ContextCollectionId  : 00000000-0000-0000-0000-000000000000
UpgradedPersistedProperties :

Id                               : 6d505269-a988-46b5-aea1-62f15927714f
Name                         :
SiteId                         : 59682d29-9241-468c-8d73-93b6e74c7a45
WebId                        : 8e1c6b34-9434-4c4d-9ca7-b057f0fd5983
HostId                       : 40187fd3-0178-46f7-b89e-233b7e83a739
HostType                  : List
ParentHostId             : 00000000-0000-0000-0000-000000000000
ParentHostType        : Site
Synchronization       : Synchronous
Type                         : ItemUpdating
SequenceNumber     : 10000
Assembly                 : Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Class                       : Microsoft.SharePoint.SolutionGalleryEventReceiver
Data                        :
Filter                      :
Credential                  : 0
ContextItemId               : 0
ContextItemUrl              :
ContextType                 : 00000000-0000-0000-0000-000000000000
ContextEventType            : 00000000-0000-0000-0000-000000000000
ContextId                   : 00000000-0000-0000-0000-000000000000
ContextObjectId             : 00000000-0000-0000-0000-000000000000
ContextCollectionId         : 00000000-0000-0000-0000-000000000000
UpgradedPersistedProperties :

Id                          : 099a4e0c-1e76-46ce-8c3c-549968535658
Name                        :
SiteId                      : 59682d29-9241-468c-8d73-93b6e74c7a45
WebId                       : 8e1c6b34-9434-4c4d-9ca7-b057f0fd5983
HostId                      : 40187fd3-0178-46f7-b89e-233b7e83a739
HostType                    : List
ParentHostId                : 00000000-0000-0000-0000-000000000000
ParentHostType              : Site
Synchronization             : Synchronous
Type                        : ItemDeleting
SequenceNumber              : 10000
Assembly                    : Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Class                       : Microsoft.SharePoint.SolutionGalleryEventReceiver
Data                        :
Filter                      :
Credential                  : 0
ContextItemId               : 0
ContextItemUrl              :
ContextType                 : 00000000-0000-0000-0000-000000000000
ContextEventType            : 00000000-0000-0000-0000-000000000000
ContextId                   : 00000000-0000-0000-0000-000000000000
ContextObjectId             : 00000000-0000-0000-0000-000000000000
ContextCollectionId         : 00000000-0000-0000-0000-000000000000
UpgradedPersistedProperties :

Id                          : 7cd2ee61-7a30-4956-9f6c-3ea10c6c4be9
Name                        :
SiteId                      : 59682d29-9241-468c-8d73-93b6e74c7a45
WebId                       : 8e1c6b34-9434-4c4d-9ca7-b057f0fd5983
HostId                      : 40187fd3-0178-46f7-b89e-233b7e83a739
HostType                    : List
ParentHostId                : 00000000-0000-0000-0000-000000000000
ParentHostType              : Site
Synchronization             : Synchronous
Type                        : ItemAdded
SequenceNumber              : 10000
Assembly                    : Microsoft.Office.Access.Server.Application, Version=14.0.0.0, Culture=neutral, PublicKeyT
                              oken=71e9bce111e9429c
Class                       : Microsoft.Office.Access.Server.Template.SolutionGalleryEventReceiver
Data                        :
Filter                      :
Credential                  : 0
ContextItemId               : 0
ContextItemUrl              :
ContextType                 : 00000000-0000-0000-0000-000000000000
ContextEventType            : 00000000-0000-0000-0000-000000000000
ContextId                   : 00000000-0000-0000-0000-000000000000
ContextObjectId             : 00000000-0000-0000-0000-000000000000
ContextCollectionId         : 00000000-0000-0000-0000-000000000000
UpgradedPersistedProperties :

Well, you might have the idea to fix this issue on any site collections that are having this issue. The solution is to add back the two missing event receivers are ItemUpdating and ItemDeleting to on the Site Collection “Solution Gallery” list. Here is the powershell command you could use.

$web = get-spweb http://siteCollectionName

$sg = $web.lists[“solution gallery”]

$sg.EventReceivers.Add("ItemDeleting", "Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c", "Microsoft.SharePoint.SolutionGalleryEventReceiver")

$sg.EventReceivers.Add("ItemUpdating", "Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c", "Microsoft.SharePoint.SolutionGalleryEventReceiver")

$web.update()

Now, site owners are NOT able to delete site templates or sandbox solutions from solution gallery without deactivating them on load balanced multiple tier environment through edit item!

NextLabs’ Entitlement Manager Issue #4 - Could not Apply Policy To RSS feeds

If we apply policy to deny acccess to the list or library, users will get error when he/she try to access the list or library.

One example is to deny acccess to the following list http://xnetsbx-sp/corp/Firethorn/IT/Lists/Harry/AllItems.aspx with two items.

 

Users will get the error if try to acccess the list from UI.

 

However, if the users try to access the list through RSS feeds using the following URL http://xnetsbx-sp/corp/Firethorn/IT/_layouts/listfeed.aspx?List={E3056893-AA99-4A89-9465-1D27DBADA90D}&Source=http%3A%2F%2Fxnetsbx-sp%2Fcorp%2FFirethorn%2FIT%2FLists%2FHarry%2FAllItems.aspx, users are NOT blocked.

It does not seem that NextLabs will apply security policy to the RSS feeds. We had same issue that security polciy could not be applied to SOAP, REST, or server side API as we discovered.

Strange SharePoint user issue on 2010 version

We have one SharePoint user reported his alert email is different from his email account.

His correct userID is “NA\virajm” and the email should be userID@qualcomm.com as indicated in AD. However the email looks likeuserID@quicinc.com that is different from the correct email. In addition, we check the alert on the site, the alert displayed is “virajm_alias (NA\virajm_alias)” as in the screen shot. 

We have tried to verify this user from four different webapps and found his name is displayed in three different ways. Here are the steps to search the user from people picker on different four webapps (SharePoint, Projects, MySites, and central admin).

Site Actions->Site Permissions->Grant Permissions->Browse User Picker-> Enter virajm and search

1. From Projects webapp that contains the lisrary that user has set up the alert, we noticed two entries.

2. From another SharePoint webapp, we noticed one entry but incorrect email userID@quicinc.com.

3. Form mysite webapp and central admin webapps, we noticed one entry with correct email userID@qualcomm.com.

If we display the hidden user list http://webapp/siteURL/_catalogs/users/simple.aspx, we have only one entry related to the user with correct name. Click the name will display the mysite for the user.

 

We have done the full user profile sync and we have no people picker customization for these webapps. At this point, I’m not able to explain what happened and have no idea how to debug and resolve this strange issue. 

If you have any suggestion to debug this issue, please let me know.

Added on 8/22: We just found the issue and way to resolve it. The issues is there is one more entry for this user inside user hidden list as you can see in the screen shot.

 Here is the workaround to resolve this.
1. Go to user alert manager page and delete the alert for the user. Site Settings->Site Administration->User alerts and select the user and delete the alert
2. Go to user hidden list and delete the user virajm_alias
3. Recreate the alert for this user

Although problem resolved, we still not sure how this invalid user was created on the site. This is still mystery.

NextLabs’ Entitlement Manager Issue #3 - Could not Apply Policy To Downloaded Documents in Outlook

We are evaluating NextLabs EntitlementManager to restrict the users belong to some security groups toaccess selected site collections with sensitive information even these users have been granted the permission through individual account, any AD groups, or email list groups. After we have set up the policy and restrict the access to a list and try to access through outlook, we identified some expected behavior – the downloaded document will not be protected by the SharePoint policy!

 

Here are the procedures to reproduce the issue.

1. Connect list/library from SharePoint to outlook. Make sure you have the access.
2. Access the list/library and open one of the documents (.doc file) from outlook.
3. Apply the deny policy to the list to deny access to all .doc files. Make sure you could not access those .doc files when you try from SharePoint UI.
4. Access the list/library and open one of the documents (.doc file) from outlook.

You will see two categories of the documents as displayed in the screen shot. One category is the “Downloaded Documents” that you have viewed before. Another is “Available for Download” that you have not accessed before. You will still be able to access any documents inside “Downloaded Documents” but will NOT be able to access any documents inside “Available for Download”.

The reason this is expected because the “Downloaded Documents” are already on your local machine. Unless the content or version has been updated on SharePoint, outlook will not retrieve again the document from SharePoint. The policy could not be trigger. This is same to any other scenarios that NextLabs’ Entitlement Manager could not protect any files outside SharePoint!

This case did not seem to be critical since it only applies to ALL the following conditions.

• User has to have the access one time
• User has open the document from outlook one time
• User has not delete the local cached document
• The document on SharePoint has not been updated sine user open it from outlook

One another side, user is looking at the local document copy he/she has permission before the policy applied that is similar to look at document has been downloaded to the local.