Safely return all lists in site collection that match criteria

Question

I'm using the following code to get all "Announcement" lists in a Web Applications site collection.

Unfortunately, sometimes the current user does not have permission to that site and the page fails with an exception, even inside the try block.

What would be the right way to do the following safely for all users, where even an anonymous user would just get no results?

static public List<SPListMeta> AllSiteAnnouncementsLists()
{
    var returnList = new List<SPListMeta>();
    foreach (SPSite oSiteCollection in SPContext.Current.Web.Site.WebApplication.Sites)
    {
        var collWebs = oSiteCollection.AllWebs;
        try
        {
            foreach (SPWeb oWebsite in collWebs)
            {
                using (oWebsite)
                {
                    var collSiteLists = oWebsite.GetListsOfType(SPBaseType.GenericList);
                    returnList.AddRange(from SPList oList in collSiteLists where oList.Title == "Announcements" select new SPListMeta(oList));
                }
            }
        }
        catch
        {
        }

    }
    return returnList;
}

Exception is firing on foreach (SPWeb oWebsite in collWebs)

Answer 1

Retrieve data only
If you're only querying the items in these list then consider the following two alternatives to looping through everything:

If you can live with the delay caused by crawling use search to gather the items.

If not and you're in the "normal" situation where if a user has access to any sub site he also has at least some access to the site collection root, then you should change your code to only get the oSiteCollection.RootWeb inside a try/catch and then use SPSiteDataQuery to query the announcement list in all subsites.

Other access If your user always have access to the parent of site they have access to then you can access the root site and then as @SPArchaeologist mentinoned use GetSubwebsForCurrentUser recursively.

If access is "random" then you need to have some thing like this:

// Get login of user in some way
var userLogin = SPContect.CurrentWeb.CurrentUser.LoginName;

// Get ids of all site user has access to
var siteIds = new List<Guid>();
SPSecurity.RunWithElevatedPrivileges(() =>
  {
    using (var elevatedSiteCollection = new SPSite(oSiteCollection.ID))
    {
      foreach (SPWeb elevatedSite in elevatedSiteCollection.AllWebs) 
      {
        if(elevatedSite .DoesUserHavePermissions(userLogin, SPBasePermissions.Open))
        {
          siteIds.Add(elevatedSite.ID);
        }    
      }
    }
  });
foreach (var id in SiteIds)
{
  using (SPWeb oWebsite = oSiteCollection.OpenWeb(id))
  { 
    ...
  } 
}

Answer 2

Check if user has permission to the web before you "use" the web, SPWeb.DoesUserHavePermissions is the method you want. Example -

if(oWebsite.DoesUserHavePermissions(SPBasePermissions.Open))
 using (oWebsite)
 {
    //code
 }

kindly let me know if it worked.

Answer 3

From your comment it would seem that your problem is on the line:

 var collWebs = oSiteCollection.AllWebs; 

That call requires the user to have access to the web instances you are enumerating - it will fail as soon as you try to access a web site the user doesn't have access to. It is also useless to try to use workarounds like SPWeb.DoesUserHavePermission because you would get an access denied exception even before the call.

What you can do is the following: open a web site (maybee the root site?) that you are sure the user have access to, and then enumerate all the site under that site. You can do this with the following line of code.

SPWebCollection websForCurrentUser = theCurrentSite.OpenWeb().GetSubwebsForCurrentUser();

Here "theCurrentSite.OpenWeb()" is a call to the OpenWeb() method of a SPSite istance to get hold of the SPWeb you will base your search on - notice that you will need to have access to that "base" web site. After that you just call GetSubwebsForCurrentUser.

Answer 4

try using SPSecurity.. it will help..

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx