List is empty for user, need content viewed as administrator

Question

I have made a HttpModule that redirects a user based on values entered in a list on the site. When a user accesses the site and I check for values in the list, it returns empty. When i access the site with the system account, I get the contents of the list just fine.

I tried the following, but the list is still empty:

SPList redirects;
SPSecurity.RunWithElevatedPrivileges(
    () => redirects = web.Lists["Redirect"]);

How can I access the list in a way that returns all content, regardless of the permissions of the current user?

Answer 1

You need to create your SPWeb/SPSite inside the RunWithElevatedPriveleges block.

The query is run as the identity of the user who originally created the SPSite the SPWeb was derived from even if you execute the query inside a RunWithElevatedPriveleges block.

This is documented here on MSDN SPSecurity.RunWithElevatedPrivileges in the examples section.

You must create a new SPSite object inside the delegate because SPSite objects created outside do not have Full Control even when referenced inside the delegate. Use the using keyword to ensure that the object is disposed in the delegate.

Although the docs refer to SPSite objects the advice also applies to SPWeb objects.