Storing WebPart property per user who does not have enough privileges

Question

I am implementing a webpart, where user can change some information of the webpart itself. I store this information in webpart property.

    [WebBrowsable]
    [WebDisplayName("Group name")]
    [Category("MyWebpart")]
    [Personalizable(PersonalizationScope.User)]
    public string GroupName { get; set; }

This is a code inside of my webpart, that changes GroupName property, when user selects new group:

SPWeb web = SPContext.Current.Web;
SPFile file = web.GetFile(HttpContext.Current.Request.Url.ToString());
SPLimitedWebPartManager manager = file.GetLimitedWebPartManager(PersonalizationScope.User);
System.Web.UI.WebControls.WebParts.WebPart webPart = manager.WebParts[this.ID];
((MyWebPart)webPart).GroupName = groupNameValue;  //this is value I want to set

try
{
    web.AllowUnsafeUpdates = true;
    manager.SaveChanges(webPart);
}
finally
{
    web.AllowUnsafeUpdates = false;
}

Unfortunately, user is not allowed to change this property. I tried to user RunWithElevatedPrivileges. The property is saved, but it is saved for SHAREPOINT\System, and not for current user.

Can you suggest, how to store this webpart property per user? Is there some way to store it per logged user, within RWEP? Or is there any permission level, that I could set to Members group?

"I tried to user RunWithElevatedPrivileges. The property is saved, but it is saved for SHAREPOINT\System, and not for current user." because then you are running your code under System account or the application pool account — Muhammad Raja, Oct 04 '13 at 08:21
why don't store and retrieve values from a database instead ? — Muhammad Raja, Oct 04 '13 at 08:22

score 1 · Answer 1 · edited Apr 13 '17 at 12:41

please refer to this:

it will explain what im about to talk about! your using the spcontext is first where your going wrong!

What is the difference between SPContext.Current.Web and SPContext.Current.Site.OpenWeb()?

runwithelevatedpriv under security just doesnt work! if you use it to get the url and then set the context to openweb() than that is fine!

so once you have created a new spweb object you can set the security of runwithelevatedpriv properly!

          string userId = SPContext.Current.Site.RootWeb.CurrentUser.Name;         
          SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                using (SPSite site = new SPSite(SPContext.Current.Site.RootWeb.Url))
                {
                    using (SPWeb web = site.OpenWeb())
                    {
                        if (!web.HasUniqueRoleAssignments)
                        {
                            web.BreakRoleInheritance(false);
                        }
                        SPUser user = web.CurrentUser;
                        SPRoleAssignment roleAssignment = new SPRoleAssignment(user);
                        roleAssignment.RoleDefinitionBindings.Add(web.RoleDefinitions["Contribute"]);
                        web.RoleAssignments.Add(roleAssignment);
                        web.Update();

                        //do what you want with the new user spweb security!

                        SPFile file = web.GetFile(HttpContext.Current.Request.Url.ToString());
                        SPLimitedWebPartManager manager = file.GetLimitedWebPartManager(PersonalizationScope.User);
                        System.Web.UI.WebControls.WebParts.WebPart webPart = manager.WebParts[this.ID];
                        ((MyWebPart)webPart).GroupName = groupNameValue;  //this is value I want to set

                        try
                        {
                            web.AllowUnsafeUpdates = true;
                            manager.SaveChanges(webPart);
                        }
                        finally
                        {
                            web.AllowUnsafeUpdates = false;
                        }
                    }
                }
            });

above code is:

1) get current username before we elevate priv!

2) elevate priv changes the username to system and call spsite from context url

3) open an new spweb object to set the new security for the specified user!

4) check the user has security if it does than change it to Contribute

5) update the spweb object and do what you want within that spweb object with the current username

Role Assignments, Role Definitions, and Inheritance

http://msdn.microsoft.com/en-us/library/ms414036(v=office.14).aspx

SPWeb.RoleDefinitions property

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spweb.roledefinitions.aspx

Storing WebPart property per user who does not have enough privileges

3 Answers3