ItemAdding event and impersonation

Question

I need to modifiy the Editor/Author (modified by/created by) SharePoint built-in fields in an ItemAdding Event Receiver on a list (I cannot use the ItemAdded event).

For users with restricted permissions, these two fields won't update when changed in the ItemAdding event (the code works for users with higher permissions). I write the changed values to the AfterProperties collection.

Any way to impersonate the System User to change these two fields? Any way to write elevated to the AfterProperties collection?

Answer 1

When you impersonate, you need to recreate the SharePoint objects that you are working under the context of the impersonator. For example, if you are impersonating the System User using RunWithElevatedPrivileges, you can use the code below to recreate some of the SharePoint objects that you may need to manipulate:

public override void ItemAdding(SPItemEventProperties properties)
{
    // Get the ids of the objects that we need to work with
    Guid siteGuid = properties.SiteId;
    Guid webGuid = properties.Web.ID;
    Guid listGuid = properties.ListId;
    int listItemId = properties.ListItemId;

    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        //Get Web and Site impersonated as SHAREPOINT\System
        using (SPSite impersonatedSite = new SPSite(siteGuid))
        using (SPWeb impersonatedWeb = impersonatedSite.OpenWeb(webGuid))
        {

            SPList impersonatedList = impersonatedWeb.Lists[listGuid];
            SPListItem impersonatedListItem = impersonatedList.GetItemById(listItemId);

            // Do your work here with the impersonated objects...

        }
    }
}

Edit: I realize that your are trying to update the AfterProperties collection and that the code above probably won't help you get at that object as the impersonated user. Can you modify the impersonated ListItem object instead of modifying the AfterPropeties collection? (I haven't written an ItemAdding event receiver, so I'm not certain of its limitations)

Answer 2

Yes, you can use the RunWithElevatedPrivileges method, if you haven't tried it yet.

Answer 3

You can work with RunWithElevatedPrivileges, but its very important that you re-declare the objects you work within this block.

Also you have to set AllowUnsafeUpdates for the new SPWeb-Object to true (also within the elevatedpriv. block)

eg.

    using (SPSite elevatedSite = new SPSite(siteGuid))
    using (SPWeb web = elevatedSite.OpenWeb(webGuid))
    {
                            web.AllowUnsafeUpdates = true;
                            web.Update();

                            [your actions here ... ]
    }