Question

I have a question regarding SharePoint permission masks. In SharePoint it is possible to set the grant/deny rights using masks. Details are given the following article.

http://msdn.microsoft.com/en-us/library/dd304243(PROT.13).aspx

My question is when we have a permission/deny mask.

For example if you deny “ViewItem” permission using the central-admin, you will get 4611686844973976575 as the deny mask. This permission masks is computed by aping | to several individual permission masks.

So is it possible to extract individual permission masks which are used to calculate permission mask such as 4611686844973976575?

Thanks.

Answer 1

If you do a logical AND operation on a value such as 0x0000000000000001 for “ViewListItems” which is contained in the mask, then you will get the value itself (or 1). If you do a logical AND on a value not in that mask, like the “UseClientIntegration” value of 0x0000001000000000, then you will get a zero (0). This is something you can even test via the scientific mode of the Windows calculator app — perhaps first converting the mask to hex, such as taking your example of 4611686844973976575 from base 10 to 400000C072040BFF in hex (base 16).

To extract all values from the mask, you would have to test the initial value against all possible values. If all known permission values are documented on that page, then the answer to your question is yes. I don’t know which language you may want to accomplish this, but the basic idea in C# is:

bool CheckMask( long Mask, long TestPermission ) {
    return (Mask && TestPermission) > 0;
}

long mask = 4611686844973976575;

const long ViewListItems = 0x0000000000000001;
bool HasPermission_ViewListItems = CheckMask(mask, ViewListItems);
// HasPermission_ViewListItems is true

const long UseClientIntegration = 0x0000001000000000;
bool HasPermission_UseClientIntegration = CheckMask(mask, UseClientIntegration);
// HasPermission_UseClientIntegration is false