Infopath Item Level Security

Posted December 3rd, 2008 by Eric Webb

Man it’s been awhile since I posted last.  Since nobody reads this, I guess it doesn’t matter.

Item level security on Infopath forms has been bugging me awhile.  It should be easy to set permissions for a form in the form library by using Rules or some other method.  However, that’s not the case.

You can do it using EventReceivers, though.  And I’m happy to say that it works pretty well.  Here’s the code:

public override void ItemAdded(SPItemEventProperties properties)
{
        Guid siteID, webID, listID;
        int itemID;
        SPUser curr;
        listID = properties.ListId;

        itemID = properties.ListItem.ID;
        using (SPWeb web = properties.OpenWeb())
        {
            siteID = web.Site.ID;
            webID = web.ID;
            curr = web.CurrentUser;
        }
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            using (SPSite site = new SPSite(siteID))
            {
                using (SPWeb web = site.OpenWeb(webID))
                {
                    SPList list = web.Lists[listID];

                    SPRoleAssignmentCollection roles = list.RoleAssignments;
                    SPListItem addedItem = list.GetItemById(itemID);
                    addedItem.BreakRoleInheritance(false);

                    SPRoleDefinition roleDefinition =
                    web.RoleDefinitions.GetByType(SPRoleType.Reader);

                    SPRoleAssignment roleAssignment =
                    new SPRoleAssignment(curr.LoginName.ToString(),
                    curr.Email.ToString(), curr.Name, "");

                    roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

                    addedItem.RoleAssignments.Add(roleAssignment);

                    this.DisableEventFiring();

                    web.AllowUnsafeUpdates = true;
                    addedItem.Update();

                    this.EnableEventFiring();
                }
            }
        });

}