SharePoint Conference 2008 Dubai

The excusive Microsoft SharePoint conference 2008 Dubai is one of the
global SharePoint conferences, following closely the US (Seattle) edition.
The world-class, two days conference, to be help at the Al Bustan Rotana
Hotel in Dubai from April 7-8, will showcase latest innovations, features
and functionality for the 2007 SharePoint products and technologies.

Agenda           Speakers          Tracks              Venue              Registration    

Tip of the Week – Using Elevated Privileges

Jerry

During developing custom application for our customer I have faced
number of interesting things. So I would like to share it with you.
For those who do not know about elevated permission please consider the
following example. Just imagine that you are developing a custom
application for Contact us and Feedback. You are using a SharePoint Custom
list for storing both. But you do not want any user to access or search for
the list from the site, so you remove the list permissions so nobody can
see the list or content. This situation requires a impersonation or wrapper
around you code that will give a anonymous or intranet user the ability to
add new items. This is where impersonation or elevated permission help us.
There are many situations where we have to use impersonation in code to do
a job that the current user does not have rights to perform so you use two
types of code.

1. Custom code for Impersonation
2. SPSecurity.RunWithElevatedPrivileges(delegate() {});

Both can work great but both have some disadvantages. Major issue with
Custom Impersonation code is that you have to fix a user name and password
in the code or web.config. and you have to add the class or its Dll to all
the project that you are developing. SPSecurity.RunWithElevatedPrivileges
has a major disadvantage which I will try to explain below. Let’s consider
the same example of ContactUS

SPWeb WebSite = SPContext.Current.Web();
SPSecurity.RunWithElevatedPrivileges(delegate()
{
SPList ContactUS = Web.Lists["ContactUS"];
// Add or Update Item///
});

If you think this code will run then it is not right. This will return
an SPSecurity exception, because you have used the SPContext.Current.Web
which contains the privileges of the current user which does not have
access to that list. I have worked with many developers and almost all of
them stuck into this problem for once. The good way to use this code is to
initialize the SPWeb object inside the Elevated block. The correct code is
given below.
SPSecurity.RunWithElevatedPrivileges(delegate()
{
SPWeb WebSite = SPContext.Current.Web();
SPList ContactUS = Web.Lists["ContactUS"];
// Add or Update Item///
});

This code will run successfully.
Please do test and provide me your feedback on this.
Jerry