Is MOSS really a secure web-ready CMS?
June 6th, 2009
While I’ve not been doing a massive amount of SharePoint development in recent months, my company has decided to focus the internal technology team on a sizable web-site project. Since “time to market” was a key factor, it seemed sensible to pick an off-the-shelf content management system to drive the site. Initially we began evaluating enterprise solutions. MOSS had been selected as the CMS of choice due to a suggested perception that it was a secure and tested product.
In the Intranet world, there is some truth in the statement that SharePoint provides good security. On a company network, you can authenticate logins through a number of methods (Kerberous, LDAP) browsing the web for MOSS security brings all manner of techniques for securing SharePoint behind the firewall. However, on the web we are pretty much forced into using form based authentication in conjunction with the DotNet membership API, as with any other (DotNet) CMS. Sure, we also have the groups/roles/user permissions architecture coupled with the audience targeting on page content and the security that you get with the search engine – but we can find that out of the box on more web targeted products. The licensing required to put SharePoint on the web as a CMS is costly, and as a CMS the interface is often arguably less intuitive than the competition.
Don’t get me wrong. Exposing SharePoint over the web to leverage line of business data can be extremely useful. But for typical CMS needs, we wondered what MOSS really brought to the table. On paper it didn’t seem like enough to justify the huge time costs involved in adapting it to meet our requirements. We began evaluating it against the likes of sitecore, community server, DotNetNuke and many other leaner web-ready products and found ourselves settling on a middle-weight platform that matched our functional requirements very closely. The jury is still out on MOSS as a super secure platform for CMS, maybe you have a different oppinion?
I think the EMS/CMS Worlds are closing fast. SharePoint 2010 is touted to include vastly improved social networking solutions. I wonder what kind of security implications this relationship between behind the firewall data and the company Internet offering will have? Even in a form content staging/workflow environment will employees be able to handle the sheer power of drag-and-dropping data from the Intranet to the corporate web-site?
Tags: Security
Posted in
Uncategorized |
No Comments »
SharePoint line of business to your desktop, already here?
March 28th, 2009
Well, I haven’t written in a while.
Until last week, I’ve had virtually no interest in Microsoft Silverlight, disregarding it as nothing more than a Flash wannabe. In retrospect, rather hypocritical of me considering I’m a lover of all alternative solutions and Silverlight being not actually that horrible in practice and of course free to develop with. Then Beta 3 is announced and suddenly Silverlight is on my radar. The next version of SharePoint (Let’s call it SharePoint Office 13.5 ho-ho! he laughed knowingly at his own obscure joke*) will almost certainly include SiverLight integration of some sort, what has me jumping about in my chair and saying to people “Do you see?” is the desktop integration feature. Ripped unashamably from Adobe air, and already completely possible with Java classes and the like, Silverlight 3’s desktop integration allows you to install a Silverlight application from the browser into the desktop allowing you to continue to work with it offline and such. How soon will we see LOB SharePoint webparts which we can install on the desktop?
Why wait? I have already downloaded and installed the SDK, Microsoft Expression, marvelled at XAML and XAP and followed the early but simple tutorials which identify how desktop integration is switched on.
Whether this can be integrated into the SharePoint API and deployed from within a SharePoint page remains to be seen. Watch this space, or indeed try it out yourself and if you do get it working before me (I have actually decided not to try yet, just to let the dream live on in my head a little bit longer) please leave a comment here so we may marvel at your technical skills.
*Update: They went for SharePoint 2010 in the end, wise move
Posted in General, Sharepoint | No Comments »
3 Free Utilities a SharePoint geek should know about
February 1st, 2009
While I really need to do a full write up of all the cool stuff I’ve been doing recently integrating various jQuery tricks into SharePoint, my only real motivation for doing so would be to max out my Google page ranking as I still feel my write up last month covered everything any flexible web developer would need to know. Instead, I wanted to rave about three pieces of software that you should really check out.
1. Wink by Satish Kumar. S. is a superb piece of free software I’ve been aware of for a few years now, since it received some award or another. It allows you to record a desktop session, or a window or a rectangle of the screen or…whatever and output the playback as embedded flash on a web page, or a movie. Further more you can edit the play back to include word bubbles with messages in or arrows or button controls. You can even record sound. This week I’m producing SharePoint user training material, and Wink has allowed me to produce a number of short flash tutorials I can embed onto pages in SharePoint itself.
2. If fancy flash demo training examples don’t float your boat then Cam Studio (By various authors) is a lovely bit of free software worth a look. It allows you to record full video screen casts with sound and, if you like, embed your webcam output at the side of the screen.
3. Finally, how do you work with SharePoint at home? Myself, I don’t like to have development servers running all the time. Instead I like to virtualise. While hosting Windows 2003 on Vista ultimate was acceptable (On my quad core desktop) I’ve now discovered the joy of running Sun’s Virtual Box using Linux as a host (If you’re afraid of Linux scardy-pants you can try out the Windows version as an alternative to Virtual Machine or VMWare). While Vista struggled to run a SharePoint server, Ubuntu (My current Linux distro of choice) is running a Windows 2003 server and a Windows XP client machine just fine, with only the occasional slowness when both machines were updating service packs, but for the most part it’s as though they aren’t there (Vista would slow down and complain bitterly by grinding the hard drive when I tried to do anything with my virtual server). The most impressive thing is flicking between full screen mode, which when you have the ‘guest additions’ (Sun’s version of VM add ons) software installed on the target machine is a wondrous experience of effortlessness.

This has finally made Linux a very useable workspace for me as with most professional software people I’m normally stuck in a very Microsoft world day to day.

Look familiar?
Posted in Uncategorized | 1 Comment »
Adding a news ticker to your SharePoint 2007 site without Flash
December 1st, 2008
I’ve written up some notes on using jQuery to improve the look & feel of your SharePoint site. This would be especially interesting to anybody trying to develop SharePoint sites using only SharePoint designer.
In the example I upload jQuery to the site (along with a BBC news ticker plug-in) and modify the page to reference jQuery and the plug in, then I modify a data-view to consume a SharePoint list into the jQuery plug-in. Essentially ending up with a nice news ticker web part without the need for Flash, custom web-parts or development.
jQuery can essentially give you Ajax/Flash like advantages without much work on your part. Simply upload the file and start plugging in.
Tags: jQuery, news ticker, Sharepoint
Posted in
Sharepoint |
2 Comments »
Developing SharePoint 2007 sites from the outside in…
November 11th, 2008
Three handy tips for developing your MOSS site from the outside in:
1. Redirecting using the Content Editor Web Part
The “Content Editor Web Part” described in the web-part gallery as being used “for formatted text, tables, and images” is actually a handy way to embed HTML into a site page. One very handy use is to redirect users to another page , useful when a site has moved.
2. Filtering Data View hyperlinks into a Document View web part
SharePoint Designer allows you to attach a ‘Data View‘ to a SharePoint page. The standard Data View webpart is actually a rather powerful little feature which can retrieve data from various connectible sources, including other SharePoint lists. Handy if, say, you have a top level site with a list and want to feed/display the data to various sub-sites.
Data Views allow you to display list data in various ways; as text, links or even check boxes and images.
I was asked, as a fairly reasonable request, to create a set of maintainable “virtual folders” in a web part. The user wanted to be able to click on an item in a list and a “document list web part” on the same page would be ‘filtered’ to show the documents in that ‘folder‘. What is actually happening is nothing more than the filtering in the standard list view, but it allows the sub-site manager to choose what appears in the ‘virtual folder’ list, in this case a set of client/customer names.
After tearing my hair out, I eventually figured out that a Data View can be used to display the list items, which appear as links. The links point to the same page as the document list web part. When you choose to display Data View data as hyperlinks in SharePoint designer you will be able to edit the ‘hyperlink options’.

You can choose to view list data as hyperlinks
After you have set the URL (in this case the very same page) and the “Text to display” as something like {@Title} you can select the ‘Parameters’ button. This is the clever bit, you can simply force the filter parameters into the page url parameters by setting FilterValue1 as the value you want to filter by (for example {@Title} again), FilterField1 as the name of the column you want to filter, and the View to be the GUID of the webpart view in question. If you don’t know the GUID you can find it by filtering the view on the SharePoint page itself and looking in the URL, you should see the parameters exactly as we’re trying to send them. You’ll notice that the GUID is surrounded by curly braces {} when you enter these into the SharePoint designer DataView tool make sure you include them as control characters %7b and %7d otherwise it won’t work.

Editing the parameters of a hyperlink dataview
3. The amazing SharePoint designer “Error reading file” bug
Mmm. SharePoint Designer. Ever had the ‘Error reading file’ problem when trying to open an aspx page? I know I did, and despite Googling; never really found a satisfactory answer.
It seems that occasionally, for whatever reason, SharePoint designer may leave your aspx page with a horrendous amount of white-space which won’t appear in the code view. When loading the page back in, SharePoint designer will simply respond with the very informative error.
The solution is to export it locally as a file, edit it in your favourite robust text editor. Now you can’t simply remove the offending white space and import it back to the server, because it won’t reattach to the layout page, so create a new aspx page in the designer and, in the code view, copy and paste the text from the broken page into the new page. When you’re finished a bit of renaming should be all you need to switch this new page around with your broken page and hopefully it should load up in the designer tool again.
Tags: content Editor, data view, filtering, Sharepoint, tips
Posted in
Sharepoint |
2 Comments »
Useful Firefox extension of the month
September 25th, 2008
Hello,
I’ve been a bit slack in producing the Workflow article. Partly due to my impending change of employment.
One of the things that bothers me when researching anything to do with technology, is that most of the information out there exists in a fairly temporary form. Take, for example, the information available in this very blog. How do you know it will be here when you revisit tomorrow? How do you know I won’t change it? How do you know I’ve paid my subscription charge and won’t loose my webspace account before you follow the favorites link in your browser to re-read my 70-542 study guide again? RSS can be used to fix this problem to some extent, but very often information you collect from the Internet can be disjointed and unorganised. This is a problem I’ve been thinking about quite a bit lately and have even begun to design tools to address the ‘problem’ on the back of till receipts and paper bags.
However, a small group of talented researches have produced an extension for Firefox I feel would be worthy of your time. Especially if you are currently studying for an exam by collecting links on the Internet, or just researching for a project. Zotero (an open source Firefox extension) is a fantastic realisation of the kind of tool my life has been missing, in a nutshell it allows you to ’snapshot’ web pages and organise them with notes based on subject. So, say your studying for your next MCTS certification, you can create a “collection” containing all the relevant useful page from the web, store snapshots of them so that you don’t loose the data, make notes using a handy annotation tool and also, fantastically, Search through your collection for things! This is one of those extensions I won’t know how I ever lived without.
Back to SharePoint then, how about I point you at somebody else’s blog instead? Paul Culmsee writes an amusing and informative SharePoint blog which puts my efforts to shame. I strongly advise SharePoint interested parties to browse his content, the article on “why SharePoint projects fail” amused me greatly.
Tags: firefox extensions, rambling
Posted in
Sharepoint |
No Comments »
Space filler
August 30th, 2008
I’m currently preparing two write ups for this blog, the first is some simple workflow guide. The last time I looked at custom workflow within SharePoint it felt a bit rough around the edges, what with the amount of things I had to install to get VS 2005 to play ball. I’m hoping to discover an improvement.
Thought for the day. What would happen if you took one big corporation’s technology and used it with another big corporation’s technology. Answer: I’ve no idea. But I’m really thinking about..experimenting (you fool you’ll kill us all etc)
This morning WordPress identified an incoming link which led me to one stirling review of my study guide from a certain ‘Bobs’, who has just completed 70-542. Congratulations to him and thanks for the kind words. Although I’m certain that ‘Bobs’ clearly already has the genius level required to be a certified SharePoint developer regardless of a few notes and links, its good to know there are people out there who have used the write up for what it is intended for.
Posted in Uncategorized | No Comments »
Removing EventReceivers from SharePoint 2007
August 7th, 2008
I’ve updated my tool
- Allows you to un-attach event receivers from SharePoint lists WARNING: You do this at your own risk, the tool currently will not allow you to reattach them! Of course….It warns you first!
- Highlights Microsoft events (handy so you can see non-default events).
- Outputs to a local log file (if you click the checkbox).
![]() |
You can get it here
For point of reference the code used to remove EventReceivers in Sharepoint API:
| SPEventReceiverDefinition theEvent = list.EventReceivers[item GUID]; theEvent.Delete(); list.Update(); |
Tags: Removing EventReceivers
Posted in
Sharepoint |
No Comments »
Inspecting all EventReceivers in SharePoint 2007
August 6th, 2008
The Event Reciever (SPEventReceiver derived, often refered to as Event Handlers) management in out of the box SharePoint 2007 is pretty poor. If your site uses events to drive business logic you probably have no simple way of inspecting the event recievers installed on your site.
There are several fine solutions available on the web that you can install which will add the missing functionality to a SharePoint site, however I haven’t been able to find anything which I can fire up quickly – enter a site URL and see the event properties. Useful if I’m on a client site, or just want to ensure that my own event receivers have installed in the correct places.
This morning I wrote a quick and dirty application to do just that. You can download the 24kb file here, run it on a SharePoint 2007 machine as administrator. I may want to add the ability to remove selected event receivers later.
![]() |
You can also download the source code project, its a little bit rough and ready but does the job without falling over.
Tags: EventReceivers, inspector tool, list EventReceivers
Posted in
Sharepoint |
No Comments »
SharePoint CAN create CHAOS!
August 5th, 2008
A recent “To everyone it may concern” style email landed* in my inbox a couple of weeks ago linking to this article which is actually refering to this forrester report warning organisations which everyone concerned with SharePoint should indeed read.
Essentially the article, reflecting the shocking* revelation from the report, is stating that industry is adopting SharePoint as a development platform (to replace intranet sites, create collaborative portals and so on) at a rate even Microsoft weren’t prepared for and lack of expertise and foresight has resulted in many SharePoint deployments going horribly pear shaped.
I’m going to refrain from throwing in my own opinions at this stage other than to shake my head in agreement and say “Yeeees” in a very “Isn’t that obvious though?” kind of way. I’m fairly certain that, while many people may be over complicating their portal & intranet environments – rushing to uninstall Lotus notes or their legacy intranet systems and install the mighty SharePoint (because it does everything!) causing chaos left right and center because they are “messing with powers they can’t possibly comprehend!”, nobody will in fact be seriously harmed in the madness.
* lie 1: emails do not land or fly and must be fetched
* lie 2: This is not shocking, it is in fact blindingly obvious
Posted in Sharepoint | No Comments »
Frustrations with Check in/Check out event handlers
July 31st, 2008
I wanted to write up some notes about a recent frustration I’ve had with Sharepoint 2007 events. I was asked to develop a (fairly simple) method of replicating the check in/check out event between a master Sharepoint site and several replica sites (Where the Sharepoint data has been replicated using my company’s own software). I’ve implemented a fairly simple system involving an event handler installed on the replica machines and a web service on the master. The concept is straightforward enough, and ensures that users are unable to check out documents that are already checked out elsewhere and that checked in data is up to date (as well as handling version numbers and undo check-out requests!).
The check in/check out system is not the focus of this blog entry. The frustration I spoke of earlier involves the SPItemEventProperties ErrorMessage property which can be set when you override the synchronous/asynchronous event functions.
So I have a class like this:
| … public class CheckingEvent : SPItemEventReceiver {… public override void ItemCheckingOut(SPItemEventProperties properties) { // business logic …… // if something bad happens{… properties.Cancel = true; ;} |
..Please excuse lack of indenting, I am still fighting with WordPress to be able to display code in a presentable fashion..
Updating the ErrorMessage property like this would normally display the error message within the browser…nice. Except in this case, checking out, it doesn’t work due to a bug in SharePoint! Instead we are treated to a message box appearing proudly displaying the words “Attempted to read or write protected memory“. Smashing..not..
At the moment, even with all the current service packs installed I can’t get the error message to appear correctly.
Currently the ONLY workaround I have found is to implement:
| properties.Status = SPEventReceiverStatus.CancelNoError; |
..instead. Which will display the standard error message. “You may not have permission to check out the document or it is already checked out or locked for editing by another user.” which isn’t great, but it at least makes my solution usable until Microsoft fix the bug.
Tags: event handlers, Sharepoint
Posted in
Sharepoint |
1 Comment »

