0

I'm facing a problem betweek "claim passage", "token" and Search. Looking online this is a well known bug that everybody solves creating a custom security trimmer...

My solution to the problem works like this:

  • Search With Elevated Privileges
  • Get the token for the user I want to act like
  • Try to access the Url returned from search
  • If ok => Return it
  • If not ok => not return it

This works correctly but.... Is there any way MORE efficent? If I access to the Item with Elevated Privileges and Check security for the user I pass it is that more efficent?

The way I'm using is like that:

using (SPSite site = new SPSite(ItemURL, token))
            {
                using (SPWeb web = site.OpenWeb())
                {
                    bool security = SPSecurity.CatchAccessDeniedException;

                    SPSecurity.CatchAccessDeniedException = false;

                    try
                    {
                        Match m = Regex.Match(ItemURL, "ID=[0-9]+".ToLower()); //GET ID
                        int listItemID;
                        if (!int.TryParse(Regex.Match(m.Value, "[0-9]+".ToLower()).Value, out listItemID))
                        {
                            throw new Exception("Cannot access to the content: " + ItemURL + " ID: " + m.Value);
                        }
                        SPList list = web.Lists.TryGetList("Contenuti");
                        if (list != null)
                        {
                            SPListItem item = null;
                            try
                            {
                                item = list.Items.GetItemById(listItemID);
                                //OK CODE
                            }
                            catch (Exception exx)
                            {
                                //FAIL CODE
                            }

The other way I see is something like this:

 SPSecurity.RunWithElevatedPrivileges(delegate(){
 using (SPSite site = new SPSite(ItemURL))
            {
                using (SPWeb web = site.OpenWeb())
                {
                    try
                    {
                        Match m = Regex.Match(ItemURL, "ID=[0-9]+".ToLower()); //Prende l'ID
                        int listItemID;
                        if (!int.TryParse(Regex.Match(m.Value, "[0-9]+".ToLower()).Value, out listItemID))
                        {
                            throw new Exception("Cannot access: " + ItemURL + " ID: " + m.Value);
                        }
                        SPList list = web.Lists.TryGetList("Contenuti");
                        if (list != null)
                        {
                            SPListItem item = null;
                            item = list.Items.GetItemById(listItemID);
                            var permission = item.GetUserEffectivePermissions("Username");
                                if (permission >= SPBasePermissions.Open)
                                       //OK CODE
                                else
                                       //FAIL CODE

I think first way is more efficent for the access, but has worst performance caused by exception...

Any suggestion / alternative'?

Thank you!

1

The extract ID part should be something like:

Match m = Regex.Match(ItemURL, "id=(?<id>\d+)");
int listItemID;
if (!m.Success
 || !int.TryParse(m.Groups["id"].Value, out listItemID)
{
    throw new Exception("Cannot get ID from: " + ItemURL);     
}

The get ListItem part I'd code using list.GetItems with a SPQuery with the query:

<Where>
  <Eq>
    <FieldRef Name='ID'/>",
    <Value Type='Counter'>value from listItemID</Value>
  </Eq>
</Where>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.