User permissions to run custom code from Document Library

Question

I have a user that doesn't have permissions to a site (Limited Access) but have Full Control permission on one of the Document libraries within this site.

Now if the user tries to run my custom code he gets Access Denied error. Other users that have Full Control, Design or Contribute permissions on the site can run my solution without any problems.

How can I allow to users without permission on the site but only on the document library use my code?

Answer 1

You need to find the line of code that the user does not have permission to execute and make sure the instance of the SPSite and/or SPWeb is created inside of a RunWithElevatedPrivileges.

SPSecurity.RunWithElevatedPrivileges(delegate()
{
  using (SPSite site = new SPSite(SPContext.Current.Web.Site.ID)) {
    using (SPWeb web = site.OpenWeb(SPContext.Current.Web.ID)) {
      // get your document library using web instead of SPContext.Current.Web
    }
  }
});

If your code is executing in an item event receiver and you are using the properties parameter instead of SPContext, you will need to modify the code, but the RunWithElevatedPrivileges is the same.

Answer 2

Do you need to retain user access for permission trimming? If not, running elevated could be the quick and easy way to get around the problem. Remember that you'll need to open new instances of site/web inside the block as existing instances will still contain the current user's permission map.

If you don't want to do this, take a look at your code. Giving access to the document library will allow code running on a limited users behalf to access the list using the list GUID or URL/name directly. If you try to get to the list using the web that was opened under their permission, you will get access denied. Referencing /anything/ the user could not see from their browser will get access denied errors.

If the code needs to reference values from another list on which the user has no permission, you either have to run elevated, re-open the web and access the list or grant the user read access to that additional list.

If you can specify some details about what your code is touching that would be helpful.

Answer 3

As I found out the problem was with SharePoint control which called ListFieldIterator. Looks like this control execute some permission check right after Page_Load method and for some reason deny access to parent page. To workaround this issue you may set ListFieldIterator.ControlMode to Display, but it's not really good solution as the user won't have ability to edit metadata represented by ListFieldIterator.