RunWithElevatedPrivileges in SharePoint

1. RunWithElevatedPrivileges?
2. Why can’t we use RunWithElevatedPrivileges in event handlers?
3. Impersonation Improvements in SharePoint 2010 Event Receivers?
4. Best recommended practice use of it?
5. Best recommended practice to use of it in Event Receivers?
6. Best recommended practice to use of it in Feature Receivers?
7. RunWithElevatedPrivileges in visual studio workflows:
8. Is RunWithElevatedPrivileges allowed in sandbox solution?
9. By using which credentials the RunWithElevatedPrivileges will run?
10. Difference between SPSecurity.CodeToRunElevated and SPSecurity. RunWithElevatedPrivileges?

RunWithElevatedPrivileges?

As per the msdn: Executes the specified method with Full Control rights even if the user does not otherwise have Full Control. 

Whenever we use SPSecurity.RunWithElevatedPrivileges (), it will execute the code under the context of Application Pool identity, so you must ensure that the App Pool account is a member of a site collection group with sufficient perms to add/edit/delete or whatever your code is trying to do. If not, the code will quietly break without popping an exception.

Method: Microsoft.SharePoint. SPSecurity.RunWithElevatedPrivileges

The code will not run within the elevated privilege if the object accessed was not created within the SPSecurity.RunWithElevatedPrivileges block. The main reason for doing so is to ensure that all the objects are in the context of the App Pool's identity. 

What is the need of defining SPSite, SPWeb objects especially in RunWithElevatedPrivileges block? 
If you use instances of SPSite or SPWeb, obtained prior to the RunWithElevatedPrivileges block, it won't work as expected because they are already associated to a non-elevated security context[ means current logger user] 

Why can’t we use SPContext.Current.Web inside RunWithElevatedPrivileges:

SPContext.Current.Web can not be used directly with in the RunWithElevatedPrivileges block as the SPWeb object becomes a instance of current logged-in user's context and it gives the below error if tries to update any content in the same Web with READ only access.
Error : Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack.
To address the issue, a new instance of SPSite and SPWeb should be cerated within the RunWithElevatedPrivileges code block as above. 

Impersonation Improvements in SharePoint 2010 Event Receivers?

Instead of using RunWithElevatedPrivileges, In SharePoint 2010, there are new properties namely OriginatingUserToken, UserDisplayName and UserLoginName which help the developers to revert back to the original user who triggered the event very easily. 

I will update once get the clear idea on what use of the new properties OriginatingUserToken, UserDisplayName and UserLoginName introduced in SharePoint 2010.

RunWithElevatedPrivileges in visual studio workflows:

No need to use any elevated privileges when working with workflows because it runs under SharePoint System Account by default (the App Pool account).

Is RunWithElevatedPrivileges allowed in sandbox solution?

You cannot use SPSecurity.RunWithElevatedPrivileges method in case of Sandboxed solution. The main reason is Sandbox solutions execute in User Code service with limited privileges.

Best recommended practice use of it:

Can’t use SPContext inside the code being RunWithElevatedPrivileges. We may get “access denied” error if instead write the SPWeb site = SPContext.Current.Web inside the RunWithElevatedPrivileges, because your web was created in the context of the current user.

Best recommended practice is: Take the current context outside the SPSecurity.RunWithElevatedPrivileges block and then create a new instance of SPSite and SPWeb inside the block which will run under application pool identity.

Simply to say is: The objects you’re working with need to be recreated within your RunWithElevatedPrivileges code block.

  

Recommended practice #1: 

view plainprint?

1. private void Test()  
2. {  
3.     Guid webID = SPContext.Current.Web.ID;  
4.     Guid siteID = SPContext.Current.Site.ID;  
5.     SPSecurity.RunWithElevatedPrivileges(delegate()  
6.     {  
7.         using (SPSite site = new SPSite(siteID))  
8.         {  
9.             using (SPWeb web = site.OpenWeb(webID))  
10.             {  
11.                 // Code Using the SPWeb Object goes here  
12.             }  
13.         }  
14.     });  
15. }  

Best recommended practice #2: 

view plainprint?

1. private void Test()  
2.         {  
3.             SPSite site = SPContext.Current.Site;  
4.             SPWeb web = SPContext.Current.Web;  
5.   
6.             SPSecurity.RunWithElevatedPrivileges(delegate()  
7.             {  
8.                 using (SPSite CurrentSite = new SPSite(site.ID))  
9.                 {  
10.                     using (SPWeb CurrentWeb = CurrentSite.OpenWeb(web.ID))  
11.                     {  
12.                         // Code Using the SPWeb Object goes here  
13.                     }  
14.                 }  
15.             });  
16.         }  

RunWithElevatedPrivileges” in Feature Receivers: 

view plainprint?

1. [Guid("b321499d-9b43-410e-8a8f-779ffb81d738")]  
2.     public class Feature1EventReceiver : SPFeatureReceiver  
3.     {  
4.         public override void FeatureActivated(SPFeatureReceiverProperties properties)  
5.         {  
6.             try  
7.             {  
8.                 using (SPSite spSite = properties.Feature.Parent as SPSite)  
9.                 {  
10.                     using (SPWeb spWeb = spSite.OpenWeb())  
11.                     {  
12.                         SPSecurity.RunWithElevatedPrivileges(delegate()  
13.                         {  
14.                             //code here  
15.                         });  
16.                     }  
17.                 }  
18.             }  
19.             catch (Exception ex)  
20.             {  
21.             }  
22.         }  

“RunWithElevatedPrivileges” in Event Receivers: Better to use the ID properties of the properties object, to get new instances of SPSite, SPWeb and SPListItem. If you need to run actions with elevated privileges on SPSite and SPWeb object use new SPSite(properties.SiteId); and site.OpenWeb(properties.RelativeWebUrl) instead of properties.web and web.site;

Best Recommended Practice #1 

view plainprint?

1. namespace MyCustomDlgFramework.EventReceiver  
2. {  
3.     /// <summary>  
4.     /// List Item Events  
5.     /// </summary>  
6.     public class EventReceiver : SPItemEventReceiver  
7.     {  
8.        /// <summary>  
9.        /// An item is being added.  
10.        /// </summary>  
11.        public override void ItemAdding(SPItemEventProperties properties)  
12.        {  
13.            SPSecurity.RunWithElevatedPrivileges(delegate()  
14.            {  
15.                using (SPSite site = new SPSite(properties.SiteId))  
16.                {  
17.                    using (SPWeb web = site.OpenWeb(properties.RelativeWebUrl))  
18.                    {  
19.                        //code here  
20.                    }  
21.                }  
22.            });  
23.              
24.        }  
25.   
26.     }  
27. }  

Best recommended practice #2: 

view plainprint?

1. namespace MyCustomDlgFramework.MyEventReceiver  
2. {  
3.     /// <summary>  
4.     /// List Item Events  
5.     /// </summary>  
6.     public class MyEventReceiver : SPItemEventReceiver  
7.     {  
8.        /// <summary>  
9.        /// An item is being added.  
10.        /// </summary>  
11.        public override void ItemAdding(SPItemEventProperties properties)  
12.        {  
13.             using (SPSite site = new SPSite(properties.WebUrl))  
14.            {  
15.                using (SPWeb web = site.OpenWeb())  
16.                {  
17.                    SPSecurity.RunWithElevatedPrivileges(delegate()  
18.                    {    
19.                        //Code here  
20.                    });  
21.                }  
22.         }  
23.     }  
24.   }  
25. }  

Best recommended practice #3: 

view plainprint?

1. namespace MyCustomDlgFramework.EventReceiver  
2. {  
3.     /// <summary>  
4.     /// List Item Events  
5.     /// </summary>  
6.     public class EventReceiver : SPItemEventReceiver  
7.     {  
8.        /// <summary>  
9.        /// An item is being added.  
10.        /// </summary>  
11.        public override void ItemAdding(SPItemEventProperties properties)  
12.        {  
13.            SPSecurity.RunWithElevatedPrivileges(delegate()  
14.            {  
15.                using (SPWeb web = properties.OpenWeb())  
16.                {  
17.                    //Code here  
18.                }  
19.   
20.            });  
21.        }  
22.   
23.     }  
24. }  

Chances of getting “Access Dined” error:

view plainprint?

1. private void Test()  
2.         {  
3.             SPSecurity.RunWithElevatedPrivileges(delegate()  
4.             {  
5.                 SPWeb currentWeb = SPContext.Current.Web;  
6.                 SPList spList = currentWeb.Lists["MyList"];  
7.             });  
8.         }  

view plainprint?

1. private void Test()  
2. {  
3.     SPSecurity.RunWithElevatedPrivileges(delegate()  
4.     {  
5.         using (SPSite currentSite = new SPSite(SPContext.Current.Site.Url))  
6.         {  
7.             using (SPWeb currentWeb = currentSite.OpenWeb())  
8.             {  
9.                 // Access granted as System account!!   
10.             }  
11.         }  
12.     });  
13. }  

view plainprint?

1. private void Test()  
2.         {  
3.             SPSecurity.RunWithElevatedPrivileges(delegate()  
4.             {  
5.                 SPSite site = SPContext.Current.Site;  
6.                 SPWeb web = SPContext.Current.Web;  
7.                 web.AllowUnsafeUpdates = true;  
8.   
9.                 SPList list = web.Lists["MyList"];  
10.                 SPListItem item = list.GetItemById(1);  
11.                 item["MyField"] = "SharePoint";  
12.                 item.Update();  
13.   
14.                 web.AllowUnsafeUpdates = false;  
15.             });  
16.         }  

Reason: SPContext.Current.Site and SPContext.Current.Web runs the List Item update code in the context of the currently logged in user and not in the context of the App Pool identity.