get_lists results in access denied

Question

I am using the code below to get all the list of a site. However the user might not have access to all lists, so how can I get only the list the current user has access to?

When accessing the site with an unprivileged user the code below results in

Error: Access denied. You do not have permission to perform this action or access this resource.

Any help here would be much appreciated

var ctx = SP.ClientContext.get_current();
var web = ctx.get_site().get_rootWeb();

function MyFunction(web) {
    var ctx = web.get_context();
    var webs  = web.getSubwebsForCurrentUser(null); 
    var lists = web.get_lists();
    ctx.load(webs, 'Include(Title,Webs,Url)');
    ctx.load(lists,'Include(Title,RootFolder,Hidden)');
    ctx.executeQueryAsync(
        function() { ... },
        function(sender,args){
            console.log('Error: ' + args.get_message());
        }
    );
}

MyFunction(web);

Edit: I thought I mention that the code works fine without the get_lists, it shows me the sites the user can access, but I now would like to do the same for the lists on the sites.

Answer 1

SharePoint CSOM does not allow for elevated privileges within it's code. This is not a bad thing. If you have a site open to the public, they could do whatever they want by adding a script at their end that ignores the security on your site.

To get around this, you will need to write a web service on the SP server side that will authenticate the user and run your reads and updates from there. You can make the call from the client side and have some authentication in place to ensure the user accessing the web service can do it. What you are attempting cannot be done within the context you are working.

Another option is to accomplish this with a SharePoint add in. You can then allow your add-in to run with elevated privileges to accomplish your needs. Here is some information on that: https://msdn.microsoft.com/en-us/library/office/mt210897.aspx

Answer 2

Ran into the same issue today. What seems to fix it:

1. remove the include statement when loading the lists (I only tested the scenario with RootFolder, maybe Title and Url are 'safe').
2. fetch the needed properties inside the loop; per returned list item

Not the prettiest of solutions, but better than an access denied message.

Answer 3

Sorry for the very late post to this question. I solved it a while ago, but forgot to post what I did. I hope this will help someone.

I ended up using the REST API instead. It essentially is now based around the following ajax call:

jQuery.ajax({
    type: "GET",
    url: origin + siteCollectionUrl + url + "/_api/web/lists?$select=title,hidden,parentweburl,entitytypename,basetype,isapplicationlist,EffectiveBasePermissions",
    headers: { "Accept":"application/json; odata=verbose"},
    dataType: "json",
    success: parseListData,
    error: error
});

Where the parsListData function looks like this:

function parseListData(data) {
    data.d.results.sort(function(a, b) { return (a.Title < b.Title) ? -1 : ( (a.Title > b.Title) ? 1 : 0 ); }).forEach( function(list) {
        var listPerms = new SP.BasePermissions();
        listPerms.initPropertiesFromJson(list.EffectiveBasePermissions);
        // If the user has at least read access to the list, the list isn't hidden
        if (listPerms.has(SP.PermissionKind.viewListItems) && ! list.Hidden ) {

            ...

        }
    });
}