Adding to Sharepoint List as Anonymous user

Question

right now, I'm using the SPSecurity.RunWithElevatedPrivileges method to let anonymous users add list items to a list. What i would like to do is make a general method that takes a Site, List and List item as an argument and adds the item to the list being passed. Right now I have :

public static void AddItemElevated(Guid siteID, SPListItem item, SPList list)
{
    SPSite mySite = SPContext.Current.Site;
    SPList myList = WPToolKit.GetSPList(mySite, listPath);
    SPWeb myWeb = myList.ParentWeb;
    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite eleSite = new SPSite(mySite.ID))
        {
            using (SPWeb eleWeb = eleSite.OpenWeb(myWeb.ID))
            {
                eleWeb.AllowUnsafeUpdates = true;
                SPList eleList = eleWeb.Lists[myList.Title];
                SPListItem itemToAdd = list.Items.Add();
                itemToAdd = item;
                itemToAdd.Update();
                eleWeb.AllowUnsafeUpdates = false;
            }

        }
    });
}

The problem is that 'item' gets initialized outside of the elevated privileges so when 'itemToAdd' is set to 'item' it loses its elevated privileges, causing the code to break at 'item.update()' if used my an non-privileged user.

Any Thoughts?

Answer 1

The problem could be because you are passing in your list. Try just passing in the list name and then grabbing the list from the elevated web like this:

public static void AddItemElevated(SPListItem itemToAdd, string listName)
{  
  SPWeb web = SPContext.Current.Web;

    SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        using (SPSite elevatedSite = new SPSite(web.Url))
        {
            using (SPWeb elevatedWeb = elevatedSite.OpenWeb())
            {
                elevatedWeb.AllowUnsafeUpdates = true;
                SPList list = elevatedWeb.Lists[listName];
                SPListItem item = list.Items.Add();
                item = itemToAdd;
                item.Update();
                elevatedWeb.AllowUnsafeUpdates = false;
            }
        }
    }
}

Answer 2

Following line itemToAdd = item; does something strange - you adding item to one list (with list.Items.Add() ) but updating item from another list/location (one that comes as argument).

Not sure what you actually want, but maybe you want to co copy all fileds from item to itemToAdd. Consider in this case to pass fieldName/value pairs as argument to make it clear that you are adding new item with given values.

Note, that anonymous users are able to add items to lists that explicitly allow it.

Answer 3

If item is coming from an SPList.AddItem() method, the splist instance must be get from an elevated web. otherwise this code will always break for anonymous users.

or you can allow anonymous user to add item to list, so you won't need running the code with elevated privileges.

by the way, itemToAdd = item; is not a correct way of setting the new added item to an old instance.

Answer 4

I haven't tried it but possibly this could help - http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.splistitem.copyto.aspx

Regards, Nitin Rastogi