Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a strong gut feeling that using SharePoint's RunWithElevatedPrivileges should be avoided like the plague, but need to convince some others as to exactly why. Here's what I have.

  • Spawns a new thread with elevated privileges
  • Blocks other operations until the passed delegate returns
  • Security problems (runs with a high level of priviledges, perhaps by an end user)
  • Others?

Originally posted to Stack Overflow.

share|improve this question
add comment

5 Answers 5

I'm surprised to hear your opposition to rwep. Certain tasks require the elevation of privileges and managed properly, rwep is often your best bet.

Sure there are potential issues, but that can be said about anything. For example, the attaching of event receivers to a list can cause lists to stop working, take more resources, and forces you to update an assembly to change functionality (as opposed to SPD workflows, for example). However, that doesn't make event receivers bad, it just means you need a working brain to put it to proper use.

So no, I can't help you with convincing others because I'm not convinced you are right.

.b

share|improve this answer
    
This matches other feedback I've gotten thus far. Perhaps it would more aptly be titled "Proper Use of RWEP" –  Chris Ballance Oct 6 '09 at 21:48
    
You may encounter unexpected behavior with that API call. Read about the best practices and proceed with caution. Daniel Larson's Windwows Live Blog appears to be down, but there is a copy at this address: soumya-sharepointblog.blogspot.com/2008/07/… –  Tom Resing May 27 '10 at 18:42
add comment

I think Keith already answered that question nicely on stackoverflow

http://stackoverflow.com/questions/1525953/sharepoint-2007-runwithelevatedprivileges-pitfalls-of-using-this

The quirky nature of RWEP makes me prefer SPUserToken over RWEP

share|improve this answer
    
cool seems i cant add more than one hyperlink. rest of post: Dan Larsson has these recommendations for using RWEP: daniellarson.spaces.live.com/blog/… –  Anders Rask Oct 6 '09 at 23:10
add comment

If you are only trying to update SharePoint objects, you should impersonate the System Account, not RWEP.

share|improve this answer
    
Thanks for adding this Paul. It's perfectly clear how muddy this is, but your statement is on point. –  Tom Resing Jun 22 '10 at 21:37
add comment

When I started learning about RunWithElevatedPrivilege I ran in to Daniel Larson's lolcats posts...

http://daniellarson.spaces.live.com/blog/cns!D3543C5837291E93!1977.entry

This left me feeling the same about it as you mentioned in your opening post. So I brought the subject up at the "Ask the Experts" development panel during the SharePoint Best Practices Conference in London April 09 (which included top developers like Andrew Connell, Todd Bleeker, Andrew Woodward and Chris O'Brien). There was unanimous agreement by the panel that it was perfectly acceptable to use. Like Bjørn mentions, there are potential issues (similar to a lot of development), but once you understand how to use it there should be no issues.

share|improve this answer
add comment

I'm using RunWithElevatedPrivileges quite a lot in code. For ex: you want to read/update lists or doc.libs where the current user doesn't have contribute access or even read access but still you want to have the web part or other view be able to send data to the user.

There are many cases where you can't move forward without using RunWithElevatedPrivileges(), don't be afraid to use that.

share|improve this answer
    
Please see Paul's note below. –  Tom Resing Jun 22 '10 at 21:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.