1

In my event receiver, I am trying to break item permission. Following is my code.

SPSecurity.RunWithElevatedPrivileges(delegate() {
    if (properties.List.Title == "Validation Draft") {
        if (properties.AfterProperties["Status"].ToString() == "APP") {
            using(var spSite = new SPSite(properties.SiteId)) {
                using(var spWeb = spSite.OpenWeb()) {
                    var item = properties.ListItem;
                    if (!item.HasUniqueRoleAssignments) {
                        item.BreakRoleInheritance(false, true);
                    }

                    var validationMemberGroup = spWeb.Groups.GetByName("Aurora Validation Members");
                    var validationReviewerGroup = spWeb.Groups.GetByName("Aurora Validation Reviewer");
                    var validationApproverGroup = spWeb.Groups.GetByName("Aurora Validation Approver");

                    var assignedTo = new SPFieldUserValue(spWeb, item["Assigned_x0020_To0"].ToString());

                    SPRoleDefinition roleDefintion = spWeb.RoleDefinitions.GetByType(SPRoleType.Reader);

                    // read permission to assignedTo
                    SPRoleAssignment assignedToRoleAssignment = new SPRoleAssignment(assignedTo.User);
                    assignedToRoleAssignment.RoleDefinitionBindings.Add(roleDefintion);
                    item.RoleAssignments.Add(assignedToRoleAssignment);

                    // read permission to Validation Members
                    SPRoleAssignment validationMemberGroupRoleAssignment = new SPRoleAssignment(validationMemberGroup);
                    validationMemberGroupRoleAssignment.RoleDefinitionBindings.Add(roleDefintion);
                    item.RoleAssignments.Add(validationMemberGroupRoleAssignment);

                    // read permission to Validation Reviewer
                    SPRoleAssignment validationReviewerGroupRoleAssignment = new SPRoleAssignment(validationReviewerGroup);
                    validationReviewerGroupRoleAssignment.RoleDefinitionBindings.Add(roleDefintion);
                    item.RoleAssignments.Add(validationReviewerGroupRoleAssignment);

                    // read permission to Validation Approver
                    SPRoleAssignment validationApproverGroupRoleAssignment = new SPRoleAssignment(validationApproverGroup);
                    validationApproverGroupRoleAssignment.RoleDefinitionBindings.Add(roleDefintion);
                    item.RoleAssignments.Add(validationApproverGroupRoleAssignment);
                    item.Update();
                }
            }
        }
    }
});

Unfortunately it works for site admins only but not for the other users.

2
  1. There's no point in opening an elevated section and a new SPWeb object under it if finally you use the initial (non-elevated) properties.ListItem object. properties.ListItem won't be elevated even if used inside RunWithElevatedPrivileges. You need to retrieve a new reference to the item from the elevated SPWeb (i.e. your spWeb):

    var list = spWeb.Lists[properties.ListId];  
    var item = list.GetItemById(properties.ListItemId);
    
  2. item.Update(); is not needed here: .Update is required when you change values, not when dealing with permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.