Understanding runwithelevatedprivilege in SharePoint 2010

SharePoint is been around for sometime now and there are substantial amount of developer community behind SharePoint. There is also huge push on the enterprise to adopt SharePoint for variety of applications varying from single farm to large scale implementation.Everyone of us would have written code in SharePoint that requires to run with elevated privileges. There are times we tend to miss the fact that run with elevated privilege is a delegate which requires all the SharePoint objects to be created again.  I wanted to write down some of the best practices that one should keep in mind while using run with elevated privilege and which objects should be created again within the elevated context.

Please feel free to add your suggestions in comments.

Primitive ojects	SharePoint Objects
Primitive Objects Viz: String, int, Float etc	All sharepoint objects Viz: SPSite, SPWeb, SPListItem, SPSList etc
Can be passed from call outside elevated privileges	Cannot pass these objects because of different context where it is created
	Always create new SPSite and SPWeb Object
	Dispose all the objects once it is used or while leaving the delegate.
	Use only when needed and do not use it to bypass security. Instead use impersonation using SPUser Token

User Information List

This past week we are were getting ourselves ready for the christmas party and holidays. We are done with one of our big project and wanted to chill out during this holiday. Ironically this happened that one of our developer brought up an interesting question about sharepoint. In our project we had to see whetehr user exists and since we had sites and subsite present in the site structure we were using 

     Web.Users["username"]  and web.SiteUser["username"]

The question was

  is there a nice way to get the user information than using users?

The reason he wanted to know was these objects were uses interchangeably and some time the web.users throw an exception and then had to go through siteusers. I set to investigate further and I also remembered that there is list in sharepoint where users are stored. But I totally forgot about it. It is the userinformation List. Here you have information about the user as soon as the user is created and Sharepoint is using this list for its operation like when you have a document or item created in sharepoint CreatedBy and ModifiedBy is all getting information from this List. This List is what used to by sharepoint to track the changes and user who performs it (Audit).

Here is a code to get information from usre information list.

Remember, this list is hidden and you need to be an administrator to access this list.

Here is how you can access the list from UI

URL : [SiteURL]/_catalogs/users/detail.aspx 

I am not using the Name in my CAML rather email field to run the query. Also getting the user like this will be more useful if you are performing other operation with the user information.

Code:

SPSecurity.RunWithElevatedPrivileges(delegate()
            {

                using (SPSite site = new SPSite(SPContext.Current.Web.Url))
                {
                    using (SPWeb web = site.OpenWeb())
                    {


                        int userId = SPContext.Current.Web.CurrentUser.ID;
                        string userName = SPContext.Current.Web.CurrentUser.Email;

                        SPList userInformationList = SPContext.Current.Web.SiteUserInfoList;


                       SPListItem userItem = userInformationList.Items.GetItemById(userId);

                        SPQuery query = new SPQuery();

                         string queryString =  string.Format("<Where><Eq><FieldRef Name='EMail' /><Value Type='Text'>{0}</Value></Eq></Where>",userName);
                        query.Query = queryString;
                        SPListItemCollection userItems = userInformationList.GetItems(query);

                        if (userItems != null && userItems.Count > 0)
                        {
                            console.Writeline("User Found");
                        }

}

}

});