Add item to list anonymously (not as anonymous user)?

Question

I have a requirement that authenticated users should be able to anonymously add items to a list, i.e. they are authenticated but the Created By/Modified By field should not display their name. I could just hide the fields from the view but the client does not even want users with site coll admin to be able to see who added what Item. I guess I could to this with an event receiver that change the fields in question to store a service account but is there another way of doing it without involving custom code?

Thanks in advance.

Answer 1

You can do it via Central Admin but I would not recommend it use this procedure for all the authenticated users.

• In Central Admin, go to Application Management, then click on 'Policy for Web application' under 'Application Security'.

• Select the SharePoint web application you're uploading documents to
  and click 'Add Users'.

• Select the desired zone (or 'All zones') and click 'Next'.

• Specify your account name, check the box for 'Full Control', and
  check the box labeled 'Account operates as System', then click
  'Finish'.

The recommended way is of course to use the Event receiver to the list and use item.SystemUpdate(). See the code below:

public override void ItemAdded
                          (SPItemEventProperties properties)
{
   SPUser adminUser =
       properties.Web.EnsureUser("GEEKTRAINER\\charrison");
   using (SPSite site =
       new SPSite(properties.WebUrl, adminUser.UserToken))
   using (SPWeb web = site.OpenWeb()) {
     SPList list = web.Lists[properties.ListId];
     SPListItem item = list.GetItemById(properties.ListItemId);

     item.BreakRoleInheritance(true);
     item.SystemUpdate();
   }


 }

SystemUpdate has two two overloads, SystemUpdate() and SystemUpdate(boolean). The second overload allows you to control if a new version is created by passing in true. The default (no parameters overload) is false – don’t create a new version.

Answer 2

I think for this you can use the List.SystemUpdate()

With item.Update(), we update the changes that are made to the list item. Is that all what it does? No, internally it also updates the "ModifiedBy" and "ModifiedOn" fields as per the current logged in user and current server time. Optionally it also updates the version of the item if the Versioning option is turned on for that specific list.

So, at any point if we wish not to update these extra things i.e. the "ModifiedOn", "ModifiedBy" and the "Item Version", then the solution for it is to use item.SystemUpdate() instead of item.Update(). This will help you in updating only those fields which are specified within your code blocks.

Answer 3

You could always have a code running on ItemUpdated part of an item event receiver that should run in a SPSecurity.RunWithElevatedPrivileges and perform an update with it, or use something similar to this to update with an specific "dummy user" (check code - i've just written it on spot!).

You would need to validate what happens if you have Versioning enabled (if there is a case for that!)

using(SPSite currentSite = new SPSite(properties.Site.Url))
{ 
    SPWeb oWeb = oSite.OpenWeb();

    SPList oList = oWeb.Lists["TestCustomList"];
    SPListItemCollection oListCollection = oList.Items;
    foreach (SPListItem oListItem in oListCollection)
    {
        SPFieldUserValue oUser =
        new SPFieldUserValue(
            oWeb,
            oWeb.CurrentUser.ID,
            oWeb.CurrentUser.LoginName);

        // or you can hard code the value like this
        SPFieldUserValue oUser = new SPFieldUserValue(oWeb, 14, "Dummy User");
        oListItem["Author"] = oUser;//created by column value = "14;#DummyUser"
        oListItem["Editor"] = oUser;//modified by column value = "14;#DummyUser"              
        oListItem.Update();              
    }         
    oWeb.Update();
}