Reference
Permissions & security
No API permissions
The package requests no API permissions. After uploading, nothing has to be approved under «API access» in the SharePoint admin center. The solution uses only the SharePoint interfaces of the respective site – with the rights of the signed-in user. The code of the solution itself contains no calls to external services.
This also means: through the form, a user can only see and change items for which they already have permissions in SharePoint. The permissions of the list and of the items remain in effect.
Who may do what?
| Task | Required permission |
|---|---|
| Deploy the package in the app catalog | SharePoint administrator or owner of the app catalog site collection |
Register the commands on SPSE (AddCommandSet.ps1) | Administrator rights on the site collection |
| Configure a web part (own configuration) | Permission to edit the page |
| Save the configuration of a list («Dynamisches Formular konfigurieren») | «Manage Web» – by default the site owners |
| Use the form (create, edit, display items) | The respective rights on the list, plus read permissions on the library config (for list configuration) |
The command «Dynamisches Formular konfigurieren» is only shown to users with the «Manage Web» permission. If the permission is missing, the dialog shows «Configuring requires the «Manage Web» permission.»
Where the configuration is stored
| Configuration | Storage location | Who needs access |
|---|---|---|
| List (command bar) | Text file config/softforge-dynamicform/form-<list ID>.txt in the document library config of the site | All users of the form need read permissions on the library |
| Web part (own configuration) | In the properties of the web part, i.e. in the page itself | Anyone who can read the page can use the web part |
The library config inherits the permissions of the site by default. If inheritance is broken and users lack read permission, the form cannot be loaded for them. The configuration contains no item data, only the structure of the form (sections, fields, rules, appearance). Still treat it like any document containing administrative information: whoever may write to the library can change the structure of a form.
More about the storage location under Installation.
Hidden fields are not access protection
Visibility rules hide fields in the form; they do not protect data. A hidden field remains visible in the list and in other views of the list. For access control on items or columns, use the permissions of SharePoint.
HTML blocks
HTML above a section is sanitized with DOMPurify when the form is displayed. Only a fixed list of harmless tags and attributes is retained (see Configuration). Scripts, embedded content, event attributes and styles are removed. Sanitizing takes place on display, not on save: the configuration still contains the text as originally entered.
Data and tenant
The solution runs as a SharePoint Framework package in the user's browser within your tenant or farm. There is no server component of its own and no database of its own. Item data is stored exclusively in the SharePoint list, the configuration in the library config or in the page.
Privacy policy and terms of use
SoftForge's privacy policy and terms of use are available at softforge.ch/privacy and softforge.ch/terms.