I have made a HttpModule that redirects a user based on values entered in a list on the site. When a user accesses the site and I check for values in the list, it returns empty. When i access the site with the system account, I get the contents of the list just fine.

I tried the following, but the list is still empty:

SPList redirects;
    () => redirects = web.Lists["Redirect"]);

How can I access the list in a way that returns all content, regardless of the permissions of the current user?


You need to create your SPWeb/SPSite inside the RunWithElevatedPriveleges block.

The query is run as the identity of the user who originally created the SPSite the SPWeb was derived from even if you execute the query inside a RunWithElevatedPriveleges block.

This is documented here on MSDN SPSecurity.RunWithElevatedPrivileges in the examples section.

You must create a new SPSite object inside the delegate because SPSite objects created outside do not have Full Control even when referenced inside the delegate. Use the using keyword to ensure that the object is disposed in the delegate.

Although the docs refer to SPSite objects the advice also applies to SPWeb objects.

  • Do you know if web.CurrentUser is still set to the correct user or if it changed to represent the System Account when inside the delegate? – cpn Nov 26 '10 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.