1

I have issu with the creating a website, the error says: "The security validation for this page is invalid"

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(SPControl.GetContextWeb(this.Context).Site.ID))
    {
        using (SPWeb web = site.OpenWeb(SPControl.GetContextWeb(this.Context).ID))
        {
            //site.WebApplication.FormDigestSettings.Enabled = false;
            site.AllowUnsafeUpdates = true;
            web.AllowUnsafeUpdates = true;
            SPWebCollection webCollection = web.Webs;
            using (SPWeb createdWeb = 
                         webCollection.Add(id, title, string.Empty, 1033, template, true, false))
            {
                newWebPath = createdWeb.Url;
            }
        }
    }
}

At the end the website is still created but i get this error thrown.

I'v read a lot of internet to add SPUtility.ValidateFormDigest(); But it doesn't really help. Because if i put this before the elevated priviliges i get this error:"Updates are currently disallowed on GET requests. To allow updates on a GET, set the 'AllowUnsafeUpdates' property on SPWeb"

I think i've tried like everything, but i still get this kind of issue...

Anyone has any idea?

I get this kind of error:

at Microsoft.SharePoint.Library.SPRequest.MoveUrl(String bstrUrl, String bstrWebRelOldUrl, String bstrWebRelNewUrl, Int32 grf) at Microsoft.SharePoint.SPFile.MoveCopyInternal(String strNewUrl, Int32 grf) at Microsoft.SharePoint.SPFile.CopyToFormsDir(String strNewUrl) at Microsoft.SharePoint.SPContentType.CopyResourcesToCore(SPContentType ct, Boolean ignoreSealedOrReadOnly, Boolean throwOnSealedOrReadOnly)
at Microsoft.SharePoint.SPContentType.CopyResourcesTo(SPContentType ct) at Microsoft.SharePoint.SPContentType.Sync(SPContentType ct, Boolean bCreateFromSTP) at Microsoft.SharePoint.SPContentType.SyncNewList(SPList list, Boolean bCreateFromSTP) at Microsoft.SharePoint.SPWeb.SyncNewLists() at Microsoft.SharePoint.SPWeb.ApplyWebTemplate(String strWebTemplate)
at Microsoft.SharePoint.SPWeb.CreateWeb(String strWebUrl, String strTitle, String strDescription, UInt32 nLCID, String strWebTemplate, Boolean bCreateUniqueSubweb, Boolean bConvertIfThere) at Microsoft.SharePoint.SPWeb.SPWebCollectionProvider.CreateWeb(String strWebUrl, String strTitle, String strDescription, UInt32 nLCID, String strWebTemplate, Boolean bCreateUniqueSubweb, Boolean bConvertIfThere) at Microsoft.SharePoint.SPWebCollection.Add(String strWebUrl, String strTitle, String strDescription, UInt32 nLCID, String strWebTemplate, Boolean useUniquePermissions, Boolean bConvertIfThere) at CustomProject.<>c_DisplayClass3.b_0()

1 Answer 1

0

Do not create site collections on a GET request. It opens you up to a denial of service attack. Typically, creating a site collection is performed in a postback from a form in which the required information is provided.

Second, you are passing in the current context into the delegate. This is a bad idea. More information here: http://www.schaeflein.net/impersonation-and-elevation-of-privilege/

Lastly, your code should be running in the Central Administration web application. That web application is likely the only one with the necessary permissions in SQL Server to create the necessary objects.

1
  • Yeah maybe, but the thing is i can create other template websites, but i do get an error only on this one :/ and this is my custom site template
    – Shkipper
    Commented Mar 11, 2014 at 6:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.