7

I have a strong gut feeling that using SharePoint's RunWithElevatedPrivileges should be avoided like the plague, but need to convince some others as to exactly why. Here's what I have.

  • Spawns a new thread with elevated privileges
  • Blocks other operations until the passed delegate returns
  • Security problems (runs with a high level of priviledges, perhaps by an end user)
  • Others?

Originally posted to Stack Overflow.

Improve this question

5 Answers 5

Reset to default
4

I think Keith already answered that question nicely on stackoverflow

https://stackoverflow.com/questions/1525953/sharepoint-2007-runwithelevatedprivileges-pitfalls-of-using-this

The quirky nature of RWEP makes me prefer SPUserToken over RWEP

Improve this answer
1
3

I'm surprised to hear your opposition to rwep. Certain tasks require the elevation of privileges and managed properly, rwep is often your best bet.

Sure there are potential issues, but that can be said about anything. For example, the attaching of event receivers to a list can cause lists to stop working, take more resources, and forces you to update an assembly to change functionality (as opposed to SPD workflows, for example). However, that doesn't make event receivers bad, it just means you need a working brain to put it to proper use.

So no, I can't help you with convincing others because I'm not convinced you are right.

.b

Improve this answer
2
  • This matches other feedback I've gotten thus far. Perhaps it would more aptly be titled "Proper Use of RWEP"
    – Chris Ballance
    Commented Oct 6, 2009 at 21:48
  • You may encounter unexpected behavior with that API call. Read about the best practices and proceed with caution. Daniel Larson's Windwows Live Blog appears to be down, but there is a copy at this address: soumya-sharepointblog.blogspot.com/2008/07/…
    – Tom Resing
    Commented May 27, 2010 at 18:42
2

If you are only trying to update SharePoint objects, you should impersonate the System Account, not RWEP.

Improve this answer
1
  • Thanks for adding this Paul. It's perfectly clear how muddy this is, but your statement is on point.
    – Tom Resing
    Commented Jun 22, 2010 at 21:37
1

I'm using RunWithElevatedPrivileges quite a lot in code. For ex: you want to read/update lists or doc.libs where the current user doesn't have contribute access or even read access but still you want to have the web part or other view be able to send data to the user.

There are many cases where you can't move forward without using RunWithElevatedPrivileges(), don't be afraid to use that.

Improve this answer
1
  • Please see Paul's note below.
    – Tom Resing
    Commented Jun 22, 2010 at 21:55
1

When I started learning about RunWithElevatedPrivilege I ran in to Daniel Larson's lolcats posts...

http://daniellarson.spaces.live.com/blog/cns!D3543C5837291E93!1977.entry

This left me feeling the same about it as you mentioned in your opening post. So I brought the subject up at the "Ask the Experts" development panel during the SharePoint Best Practices Conference in London April 09 (which included top developers like Andrew Connell, Todd Bleeker, Andrew Woodward and Chris O'Brien). There was unanimous agreement by the panel that it was perfectly acceptable to use. Like Bjørn mentions, there are potential issues (similar to a lot of development), but once you understand how to use it there should be no issues.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.