8

I am working in SharePoint 2010. My requirement is to create folder inside SharePoint layouts and create a file inside that folder. Also I need to access the file for a current logged in user.

Layouts-> Files-->file1.txt.

Please check out the code below.

String tempFilePath = SPUtility.GetGenericSetupPath(String.Empty) + "TEMPLATE\\LAYOUTS\\Files";         

DirectorySecurity securityRules = new DirectorySecurity();
securityRules.AddAccessRule(new FileSystemAccessRule(strUserName, FileSystemRights.FullControl, AccessControlType.Allow));
bool IsExist = System.IO.Directory.Exists(v);

if (!IsExist )
System.IO.Directory.CreateDirectory(tempFilePath ,securityRules); 

In the code above if the strUserName is Administrator then the directory(Files) will be created successfully. But for other than Administrator account CreateDirectory will fail( access to the path denied). Can anyone tell me how can I create the folder in sharpoint layouts for any user with full permission?

1
  • Please do not ask near identical questions - just edit your original question. I have merged the answers from your other question which I have closed.
    – SPDoctor
    Dec 29, 2012 at 11:05

4 Answers 4

6

you should impersonate user for operation

SPSecurity.RunWithElevatedPrivileges(delegate
{
    using(SPSite site = SPContext.Current.Site.ID)
    {
        using(SPWeb web =  SPContext.Current.Web.ID)
        {
           //code
        }
    }
});
4
  • Indeed, impersonation is key for any action that requires greater authority than any normal user permits ~ ~. Dec 24, 2012 at 7:31
  • Just a note your not impersonating here, your actually elevating that current logged in user
    – Ali Jafer
    Dec 24, 2012 at 8:55
  • @almostSharepointMaster, in this case the operations are made by application pool account. what is impersonating?
    – Alexander
    Dec 24, 2012 at 9:03
  • added my answer :)
    – Ali Jafer
    Dec 24, 2012 at 9:44
8

Just to clarifiy, runwithelevatedprivlages is not impersonation:

a good example is an anonymous user who you want to edit (add to) a sharepoint list that they dont have access to programmaticaly.

runwithelevatedprivlages will not work as anonymous users wouldnt have anything to elevate, this is where you need to impersonate an account that does have access. runwithelevatedprivlages works well with logged in users who dont have the right permissions.

as an example I will show you impersonation first:

to impersonate you need to get the system token first and make sharepoint think that your that person, anything within the spsite that your going to impersonate will be under that user and not the current user your using, the method below is getting the system account token with elevated privlages (for anonymous users):

    /// <summary>
    /// get the system token from the list of users to elevate spsite
    /// </summary>
    /// <param name="spSite"></param>
    /// <returns></returns>
    protected static SPUserToken GetSystemToken(SPSite spSite) 
    {     
        SPUserToken res = null;     
        bool oldCatchAccessDeniedException = spSite.CatchAccessDeniedException;
        try
        {
            spSite.CatchAccessDeniedException = false;
            res = spSite.SystemAccount.UserToken;
        }
        catch (UnauthorizedAccessException)
        {
            SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                using (SPSite elevatedSPSite = new SPSite(spSite.ID))
                    res = elevatedSPSite.SystemAccount.UserToken;
                // (***)         
            });
        }
        finally    
        {         
            spSite.CatchAccessDeniedException = oldCatchAccessDeniedException;     
        }     
        return res; 
    }

to use this method you would need to do the following:

            SPUserToken sysToken = null;
            using (SPSite spSite = new SPSite(SPContext.Current.Site.ID))
            {
                //get the system token from the method GetSystemToken and passing the spSite that you want to run under
                sysToken = GetSystemToken(spSite);

                using (SPSite impersonatedSite = new SPSite(siteUrl, sysToken))
                {
                    //we are impersonating the [@"SHAREPOINT\SYSTEM"] account
                    using (SPWeb web = impersonatedSite.OpenWeb())
                    {
                         //do your code here as the impersonated account like updating a list
                    }
                }
            }

this will work where RunWithElevatedPrivileges does not work :) as you can see there is suttle differences between the two, impersonation is not using the application pool account but rather any account that you want to impersonate. RunWithElevatedPrivileges only uses the application pool account and has some limitation to what access it has (your only elevating the current account!! not impersonating the app pool account)

msdn RunWithElevatedPrivileges explained

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx

msdn Impersonation explained

http://msdn.microsoft.com/en-us/library/aa543158(v=office.14).aspx

http://msdn.microsoft.com/en-gb/library/windows/desktop/ms691341(v=vs.85).aspx

for the op, I would suggest as others and use RunWithElevatedPrivileges as it should be more than enough :)

hope this helps :)

3
  • I think that impersonating is a method when we use another account to do some operation. for example - that cannot be done by current user. If we use RunWithElevatedPrivileges, we use application pool account, so we change current user to application pool account. am I right? Is it impersonating ?
    – Alexander
    Dec 24, 2012 at 9:56
  • in a way your right but not quite, impersonation creates a new thread and when you ammend or add somthing like to a list it will still say your name who edited the list even tho your running uneder app poool, impersonation is the opposite it doesnt start an new thread and runs on the same one, when you change the list its under the name you impersonated and not under the origional name.
    – Ali Jafer
    Dec 24, 2012 at 10:10
  • Actually, impersonation is not about creating a new thread. Impersonation is about changing the identity of a given thread. By default, a thread has the identity of its process (w3wp.exe in our case). You can impersonate another user at any time (if you can authenticate as this user) as it happens for an ASP.NET thread executing a page request, and "revert-to-self" (= impersonate to null) as RunWithElevatedPrivileges (or also HostingEnvironment.Impersonate()) does to come back to process identity. Note that RunWithElevatedPrivileges also has other effects in addition to revert-to-self.
    – Evariste
    Jul 11, 2021 at 7:35
1

You should wrap your code in SPSecurity.RunWithElevatedPrivileges:

SPSecurity.RunWithElevatedPrivileges(delegate
{
    /// your code here
});

The code inside RunWithElevatedPrivileges executes under current application pool account instead of logged in user account, so make sure that this pool account has access to local file system.

0

Why do you need to store files on file system? Will blob storage be better?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.