Web Parts that depend on WPProperty may no longer work correctly in SharePoint Server (KB5003528)

Symptoms

A Web Part that depends on WPProperty may no longer work correctly and generates a7wm1 event tags in SharePoint Unified Logging System (ULS) logs.

Cause

This issue occurs because SharePoint Server now requires farms to declare the .NET types that're allowed to access WPProperty in the web.config file. The .NET types that aren’t listed won't have access to WPProperty as a security precaution.

Resolution

To resolve this issue, install one of the following updates:

• Description of the security update for SharePoint Server 2019: September 14, 2021 (KB5002018)

• Description of the security update for SharePoint Enterprise Server 2016: June 8, 2021 (KB5001946)

• Description of the security update for SharePoint Foundation 2013: September 14, 2021 (KB5002024)

To make the Web Part work as expected, take the following steps to declare the affected .NET type(s) as allowed to access WPProperty in the web.config file.

1. Open the web.config file of your web application on each server in your SharePoint farm.

2. Find the configuration/SharePoint/SafeMode section.

3. Add an AllowedWPProperties section if it doesn’t already exist.

4. Add a new AllowedWPProperty element with type and propertyName attributes to represent the type that should be allowed to access WPProperty.
   
   <SafeMode MaxControls="200" CallStack="false" DirectFileDependencies="15" TotalFileDependencies="250" AllowPageLevelTrace="false">
       <AllowedWPProperties>
           <AllowedWPProperty type="<allowedWPPropertyTypeName>,<allowedWPPropertyAssemblyName>, <AssemblyVersion>, <AssemblyLanguageSetting>, <AssemblyPublicKey>" propertyName="<Allow WPProperty property name>"/>
       </AllowedWPProperties>
   </SafeMode>

5. Save the change to the web.config file.

To identify the correct values for the type and propertyName attributes, query the ULS log for the a7wm1 event tag and note the log entry. For example:
 
"WPProperty has been blocked for security reason. blocked AssemblyQualifiedName is "<BlockedWPPropertyTypeName>, <allowedWPPropertyAssemblyName>, <AssemblyVersion>, <AssemblyLanguageSetting>, <AssemblyPublicKey>" | blocked property name is "<blocked WPProperty name>",
 
To allow this type to access WPProperty, set the AllowedWPPProperty type attribute to the blocked AssemblyQualifiedName's value and set the propertyName attribute to the blocked property name value.

Change history

 The following table summarizes some of the most important changes to this topic.