How to restrict user rights so they can add list items but cannot edit them once saved?

Question

I appreciate if you can help me with this. My beloved company uses SP2010, and I got the task to solve this issue using it, though I am not a programmer (basic html is still ok).
I need a simple annual leave list with the following capabilities:
1. Group of users (~100 members) should be able to create list items in a list that contains annual leave data. Columns are: Name, Leave start date, Leave end date, Team leader, etc.
2. Once they fill in the new item form, a workflow notifies the team leader to visit the item and set a column "approval status" to approved or rejected.
3. Based on this column value, another workflow notifies the requestor about the decision.
4. After approval, users should be able to see their items in the list, but they should not be able to edit it.
Sounds so simple, but I have big issues with point 4. as Sharepoint does not differentiate create and edit rights to a list item. As a result, requestor can edit dates of the approved items.
Any hints how to solve this? Can impersonation help with this? Or should I add a new permission level to the site?

Answer 1

Hello
We are going to do the following things to accomplish your task
create a new security permission level that will allow submit only
create your annual leave list
assign everyone the submit only permission
add a workflow to send the email and modify the item permissions
Ok first things first, on the sharepoint server open a powershell window and type the following powershell:
$spweb=Get-SPWeb -Identity "<site url>";
$spRoleDefinition = New-Object Microsoft.SharePoint.SPRoleDefinition;
$spRoleDefinition.Name = "Submit only";
$spRoleDefinition.Description = "Can submit/add forms/files/items into library or list but cannot view/edit them.";
$spRoleDefinition.BasePermissions = "AddListItems, ViewPages, ViewFormPages, Open";
$spweb.RoleDefinitions.Add($spRoleDefinition);
$spweb.Dispose();
Now in your site you will have a new permission level called 'Submit Only'.
Create your annual leave list and give all users read and submit only permissions.
Now create a workflow against this list in sharepoint designer.
Add a new step which should be an impersonization step
1st action
add permission: give the user and their manager (i am presuming you are capturing this information in your list so it will be recorded against the item) whatever control you wish, i.e. full control, contribute, etc.
2nd action
remove list permission: remove the group you initially gave read and submit only permission to and select the read and submit only permissions to remove from them, i.e. if you added the 'All Users' group, then when performing this action choose to remove
the read and submit only permissions for the users 'All Users'.
3rd Action
Send an Email: Email Manager with notification.
Regards
Sergio Giusti
http://sergioblogs.blog.co.uk/
Whenever you see a reply and if you think is helpful, click " Vote As Helpful". And whenever you see
a reply being an answer to the question of the thread, click "
Mark As Answer".
i just face the same issue and i create a new Permission level named "Submit Only". but i also have a custom web part that is added to my Create form . so when users tried to access the Create form they will get Access Defined. so is there a way to
modify the permission level to be able to read web parts ?