Contributors can't seem to save personalisable web part properties?

Question

I've using the following code to save the week a user is currently looking at, for next time they view the web part:

private string _week = null;

[WebPartStorage(Storage.Personal)]
public string Week
{
    get
    {
        if (string.IsNullOrEmpty(_week))
        {
            _week = DateTime.Now.WeekStart(Const.StartOfWeek);
        }

        return _week;
    }

    set
    {
        _week = value;
    }
}

WeekStart is an extension method that returns a string date. Let's assume I'm using a string instead of a date for Good Reasons.

When the following method is called by the 'One week forward' button being clicked, the updated property is saved but only for administrators. For everyone else it fails to save the property:

private void rightArrowClick(object sender, System.EventArgs e)
{
    Week = Week.AddDays(7);

    SaveProperties = true;
}

Am I misunderstanding the purpose of Storage.Personal, or do the normal users need more permissions than the Contributor role allows in order for this to work?

Answer 1

As far as i remember setting properties requires Designer permissions in SP2010 (due to Fear of XSS). This might explain the behaviour you are seeing.

You may also need to switch:

[Microsoft.SharePoint.WebPartPages.WebPart.WebPartStorage(Storage.Personal)]

for the newer:

[System.Web.UI.WebControls.WebParts.Personalizable(PersonalizationScope.User)]

Answer 2

In addition to Anders' answer, I also had to change the SafeAgainstScript attribute in the SafeControl entry for the web part to True, in order for Contributors to be able to change the property.

As an interesting side-effect, those with the Designer role now all share the Shared version of the property. Whereas all normal users have their own personalised versions.

References:

Web part personalization permissions on SharePoint 2010

Personalizable web part custom property not shown for users with Contribute permission level

---

Word of warning: the SafeAgainstScript attribute is not 2007-friendly, and will fail on installation.