Access Anonymous to spSite.RootWeb.Folder[“xx”] in sharepoint 2010

Question

I wrote that method to download file from document library. But When I enter site as annonymous and try to download file, "site.RootWeb.Folders["Dokumanlar"];" this code wants authentication.

In web.config I changed trust level like this:

<trust level="Full" originUrl=""/>

What should I do? Thanks.

 private void DownloadFile() { 
var docid = HttpContext.Current.Request.QueryString["id"]; 
int id; 
int.TryParse(docid, out id); 
if (id == 0) { 
var response = HttpContext.Current.Response; 
response.Write("Enter document id"); 
response.End(); 
return; 
}
    using (SPSite site = new SPSite(SPContext.Current.Site.Url))
    {
        var dataContext = new KysDataContext(site.Url);
        var docs = dataContext.Dokumanlar;

        if (docs == null)
        {
            return;
        }

        var dokumanlar = docs.ToList();
        var dokuman = dokumanlar.FirstOrDefault(x => x.Id == id);
        if (dokuman == null)
        {
            var response = HttpContext.Current.Response; 
            response.Write("check document id");
            response.End();
            return;
        }
        SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                var rootweb = site.RootWeb.Folders["Dokumanlar"];//this line it's want to authentication
                SPFile file = rootweb.Files[dokuman.Name];
                if (file != null)
                {

                    dokuman.Hits += 1;
                    dataContext.SubmitChanges();

                    var response = HttpContext.Current.Response;
                    response.ClearContent();
                    response.ContentEncoding = Encoding.GetEncoding("windows-1254");
                    response.Charset = "windows-1254";
                    response.ContentType = "application/content-stream";

                    response.AppendHeader("Content-Disposition",
                                          string.Format("attachment; filename={0}", file.Name));
                    response.BinaryWrite(file.OpenBinary());
                    response.End();
                    Page.ClientScript.RegisterOnSubmitStatement(typeof (Page), "closePage",
                                                                "window.onunload = CloseWindow();");

                }
            });
    }
}

Answer 1

You need to make new instance of SPSite and SPWeb inside RunWithElevatedPrivileges.

Example

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(web.Site.ID))
    {
    // implementation details omitted
    }
});

Fine print from MSDN:

"An SPSite object created outside the delegate can be referenced inside the delegate, however, the methods and property assessors of the object run with the privileges of the user context in which the objects were created, not with the elevated privileges. The same point applies to SPWeb objects and any other objects. You must create new objects inside the delegate if you need to execute the members of the objects with elevated privileges. If the new object must represent the same persisted entity as an object created outside the delegate, then you must reference identification information from the externally created object and use it to create the new object within the delegate. For example, if web is a reference to an SPWeb object created before the call to RunWithElevatedPrivileges, then the following code shows you would use the ID of its parent SPSite object to construct a new SPSite object."