I am able to update a ReadOnly field inside my CSOM code

Question

I have set a field as read-only using this PnP script, the field is of type "image or hyperlink":-

$fieldTitle = "LinkToRiskValue"
$customfield = $Context.Site.RootWeb.Fields.GetByInternalNameOrTitle($fieldTitle)
$customfield.ReadOnlyField = $true;
$customfield.UpdateAndPushChanges($true);
$Context.ExecuteQuery();

now i thought that this will prevent updating the item inside my CSOM code, but seems i can do this operation:-

context.Load(context.Site);
context.ExecuteQuery();
listItem["LinkToRiskValue"] = context.Site.Url+"/Lists/RiskValue/AllItems.aspx?FilterField1=RiskValueAsset&FilterValue1=" + listItem["Title"] + "&FilterType1=Lookup";
listItem.Update();
context.ExecuteQuery();

so does this mean that i can update a Read-Only field using CSOM?

Answer 1

Update:

Please add "ReadOnlyEnforced" in field schema so that it will also prevent field value updating from code:

# Provide credentials over here
$creds = (New-Object System.Management.Automation.PSCredential "user@tenant.onmicrosoft.com",(ConvertTo-SecureString "xxxx" -AsPlainText -Force))
 
# Provide URL of the Site over here
# If you do not wish to pass credentials hard coded then you can use: -Credentials (Get-Credential). This will prompt to enter credentials
Connect-PnPOnline -Url https://Tenant.sharepoint.com -Credentials $creds
 
# Get Context
$clientContext = Get-PnPContext
 
# -List: The list object or name of the list
# -Identity: The field object or name
$targetField = Get-PnPField -List "My New List" -Identity "LinkToRiskValue"

$targetField.SchemaXml='<Field Type="URL" DisplayName="LinkToRiskValue" Required="FALSE" EnforceUniqueValues="FALSE" ReadOnlyEnforced="TRUE" Indexed="FALSE" Format="Hyperlink" Group="Custom Columns" ID="{97e8adeb-b26d-427d-9a76-f7029c5b363a}" SourceID="{040f9461-79c2-4cda-8afe-f8b592a0b646}" StaticName="LinkToRiskValue" Name="LinkToRiskValue" Version="6" ReadOnly="TRUE" AllowDeletion="TRUE" ColName="nvarchar4" RowOrdinal="0" ColName2="nvarchar5" RowOrdinal2="0" />'

$targetField.UpdateAndPushChanges($true)

$clientContext.ExecuteQuery()

You can firstly output the field schema using Write-Host($targetField.SchemaXml), then add ReadOnlyEnforced="TRUE" manaually and then set like the PowerShell above.

I have tested with this property, it's working to prevent field updating even using code.

Reference:

Lock SharePoint column, make field ReadOnly or ReadOnlyEnforced