SharePoint Development Permissions

Question

Hi I am using the SharePoint namespace to pull items from various lists throughout the site. My web part works, but only on my account. When I try it on another account it gives me "Error: Access Denied" for the page. I have taken all web parts out and have only this web part on the page. When I remove the following lines the page loads for everyone, when I add it back in however it does not work. I am guessing this is some permission problem. I was wondering is there away to programatically query different lists on SharePoint by assigning a user id to use? Thank you for any help

...
SPSite site = new SPSite(_SPSite);           
SPWeb eachWeb = site.AllWebs[0];
SPListItemCollection myItemCollection = eachWeb.Lists["Listings"].Items;
...

Answer 1

Try:

SPWeb eachWeb = SPContext.Current.Site.RootWeb.Webs[0];
SPListItemCollection myItemCollection = eachWeb.Lists["Listings"].Items;

Remember that SPWeb should be used in a using block, or disposed of explicitly after use.

Answer 2

You're correct, the access denied error is occurring when you're using an account which does not have access to the "Listings" list in the current website.

The easiest way around the issue is to use a SPSecurity.RunWithElevatedPrivleges call:

SPSecurity.RunWithElevatedPrivleges(delegate()
{
     //Your code here
});

which will run whatever code is contained in the anonymous method using the SharePoint/System account, granting complete control. Be careful when using this technique though, as it equivalent to running code at full trust with a super user account. There are other caveats to be aware of as well.

Answer 3

As regards the first caveat from EvilGoatBob, I quote:

"If you're manipulating any Object Model elements within your elevated method, you need to get a fresh SPSite reference inside this call. For example

SPSecurity.RunWithElevatedPrivileges(delegate(){
   SPSite mySite = new SPSite(http://sharepoint/);
   SPWeb myWeb = SPSite.OpenWeb();
   // further implementation omitted
});"

Notice that the site parameter is hard-coded - this is because of a bug. If you instead had tried:

using (SPSite site = new SPSite("http://" + System.Environment.MachineName)) {}

You would get the rather generic "No SharePoint Site exists at the specified URL..." error. This caused me no end of grief. Bottom line is that you have to hard-code the server name (unless anyone has an alternative). You can also get a similar error message when debugging Web Parts for the first time with VSeWSS 1.3.

Answer 4

You do not need to hardcode the server name in this case because your requirement is to retrieve items from list inside the same site as your webpart. You are correct, if you do not have enough privileges with your account, then you get the Access Denied. The solution is to create a new SPSite object within a different security context, and do your work:

    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite site = new SPSite(SPContext.Current.Site.Url))
        {
            using (SPWeb web = site.OpenWeb())
            {
                //the web object was retrieved with elevated privileges under the system account.

                //do your work here:
                SPListItemCollection myItemCollection = web.Lists["Listings"].Items;

                //...
            }
        }
    }
    );

With the code above, your webpart is portable because there's no hardcoding, and runs in the correct security context while disposing of all unmanaged SPRequest objects created by the SPSite and SPWeb constructors.