How do I get an SPSite from SPWebEventProperties?

Question

How do I get an SPSite object from the SPWebEventProperties object passed into the SPWebEventReceiver.WebProvisioned method?

public override void WebProvisioned(SPWebEventProperties properties)

Answer 1

There is no need to create a new SPSite object. Instead use:

properties.Web.Site

Answer 2

This MSDN article Security Best Practices for Developers in SharePoint 2010 recommends against constructing SPSite objects using a Guid.

Construct SPSite Objects Safely

The Microsoft.SharePoint.SPSite constructor is prone to the following two problems:

New SPSite objects can be constructed by using a fully qualified domain name, for example http://contoso1.example.com. If this domain name is different from the current request context, it can lead to a cross-domain security issue.

New SPSite objects can be constructed by using a site identifier (ID) and optional user token, but without a fully qualified URL or Microsoft.SharePoint.Administration.SPUrlZone enumeration. If the current request context is not the Default zone, this can bypass web application policy.

It would be safer to use

properties.Web.Site

as advised by Anders