Anonymous access: Add an Item to List without allowing to View the List

Question

I'm creating a 'Contact Us' webpart with form to allow anonymous user to send a message which will be added to a SharePoint List.

However I cannot grant the anonymous user the permission to Add element to List (and therefore the permission to View the List) because he isn't supposed to see all of the messages that were previously sent by other people.

I've tried to use the following code:

SPSite siteContext = SPContext.Current.Site;
SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite elevatedSite = new SPSite(siteContext.ID))
    {
        using (SPWeb web = elevatedSite.RootWeb)
        {
            web.AllowUnsafeUpdates = true;
            SPList list = web.Lists.TryGetList("Messages");

            Guid listGuid = list.ID;
            if (listGuid != null)
            {
                RichTextField MessageField = new RichTextField();
                MessageField.ControlMode = SPControlMode.New;
                MessageField.ListId = listGuid;
                MessageField.FieldName = "Message";
                this.MessagePlaceholder.Controls.Add(MessageField);
            }

            web.AllowUnsafeUpdates = false;
        }
    }
});

But when the anonymous user proceeds to the page, the MessageField isn't rendered at all.

I guess it's because the code is pointing the field to a list which the user doesn't have access to.

What am I doing wrong? Am I missing something in my code with RunWithElevatedPrivileges? Any help would be appreciated.

Answer 1

Inspired by this post: https://sharepoint.stackexchange.com/a/36311/17191 I finally got it to work.

After:

SPList list = web.Lists.TryGetList("Messages");

I've added the line:

SPContext renderContext = SPContext.GetContext(HttpContext.Current, null, list.ID, web);

and now anonymous user can access a site with this control (without actually having any permissions to the List).

Answer 2

Have a look at the SharePoint logs. What error message are you getting? You can use this tool: http://archive.msdn.microsoft.com/ULSViewer

You can enable Anonymous Access by going to Application Management in Central Administration, Highlight the WebApop where you want to enable Anonymous Authentication, Click on Authentication Providers, Click on the Zone where you want to enable Anonymous Access, then Check Enable Anonymous Access, Save.

Go to your Web Application and the top level of the site collection > Site Actions > Site Settings > Site Permissions > Anonymous Access > Entire web Site

Check also the settings in the IIS Manager. Go to your site and open the point Authentication. Check if Anonymous Authentication is enabled. Only then the IIS will let your anonymous request pass.

Here is a good link: http://blog.drisgill.com/2009/11/sp2010-branding-tip-9-turn-on-anonymous.html