SpServices Cannot Get Sub-Sites without Being Site Collection Admin

Question

I am building a web part which is delegated by permissions. It is displayling members of the Members group and Owners group onto the page, and if a user does not have Members or Owners permissions, they will not be able to be added to the web part to be displayed in the group list, but they will still be able to see the list of those who are in the group. One of the problems I am having is the only way this is working is if I give Site Collection Admin rights to the user. When I have a user in the Groups I want, when I debug, I am getting this error in a quick watch of web.Webs

System.UnauthorizedAccessException

Here is the code I am running for the SPServices call:

SPSecurity.RunWithElevatedPrivileges(delegate()
            {

                SPSite site = SPControl.GetContextSite(Context);

                SPWeb web = site.RootWeb;

                    bool inMembersGrp = false;
                    bool inOwnersGrp = false;

                    SPGroupCollection myWebGroups = web.SiteGroups;


                    foreach (SPWeb subweb in web.Webs)
                    {
                        inMembersGrp = false;
                        inOwnersGrp = false;

                        System.Diagnostics.Debug.WriteLine(subweb.Title);

                        SPGroupCollection mySubWebGroups = subweb.SiteGroups;

                        if (GroupExists(mySubWebGroups, subweb.Title + " Members"))
                        {
                            try
                            {
                                inMembersGrp = subweb.IsCurrentUserMemberOfGroup(subweb.Groups[subweb.Title + " Members"].ID);
                            }
                            catch (SPException ex)
                            {
                                System.Diagnostics.Debug.WriteLine(ex.Message);
                            }

                        }

                        if (GroupExists(mySubWebGroups, subweb.Title + " Owners"))
                        {
                            try
                            {
                                inOwnersGrp = subweb.IsCurrentUserMemberOfGroup(subweb.Groups[subweb.Title + " Owners"].ID);
                            }
                            catch (SPException ex)
                            {
                                System.Diagnostics.Debug.WriteLine(ex.Message);
                            }

                        }

                        if (inMembersGrp || inOwnersGrp)
                        {
                            mtRow = new TableRow();
                            mtCell = new TableCell();
                            mtCell.Text = @"<a href=" + SPEncode.UrlEncodeAsUrl(subweb.Url) + " >" + subweb.Title + "</a>";

                            mtRow.Controls.Add(mtCell);
                            myGroupsTable.Controls.Add(mtRow);

                        }
                        else
                        {
                            mtRow = new TableRow();
                            mtCell = new TableCell();
                            mtCell.Text = @"<a href=" + SPEncode.UrlEncodeAsUrl(subweb.Url) + " >" + subweb.Title + "</a>";

                            mtRow.Controls.Add(mtCell);
                            allGroupsTable.Controls.Add(mtRow);

                        }

                        subweb.Dispose();
                    }

            });
        }

        catch (SPException ex)
        {
            System.Diagnostics.Debug.WriteLine(ex.Message);
        }

Any help on this would be great. I have tried taking out the SPSecurity.RunWithElevatedPrivileges call to see if maybe it was the problem, but it did not fix it. Thanks!!

Answer 1

I'm not sure but I think the issue is how you are getting your site handle. The code runs with elevated permissions but the site context you are referencing is the current one, which is the user's context. Try this instead :

SPSecurity.RunWithElevatedPrivileges(delegate()
{

   using (SPSite site = new SPSite(SPContext.Current.Web.Url)) {

   ... your code here ...

   }
}