AllowUnsafeUpdates VS RunWithElevatedPrivileges

AllowUnsafeUpdates: If your code modifies Windows SharePoint Services data in some way, you may need to allow unsafe updates on the Web site, without requiring a security validation. You can do by setting the AllowUnsafeUpdates property.

For detail click here AllowUnsafeUpdates

RunWithElevatedPrivileges : There are certain object model calls model that require site-administration privileges. To bypass access-denied error, we use RunWithElevatedPrivileges property when request is initiated by a nonprivileged user. We can successfully make calls into the object model by calling the RunWithElevatedPrivileges method provided by the SPSecurity class.

For detail click here RunWithElevatedPrivileges

Thanks!

Nikhil S.

Read More

RunWithElevatedPrivileges in SharePoint

In this article I am going to explain you that How to use RunWithElevatedPrivileges in sharepoint object model.
RunWithElevatedPrivileges
Executes the specified method with Full Control rights even if the user does not otherwise have Full Control.The next example shows the syntax that is required to define an anonymous method in the call to RunWithElevatedPrivileges.

SPSecurity.RunWithElevatedPrivileges(delegate()

{

    // implementation details omitted

});

Detail:-

The RunWithElevatedPrivileges method accepts a delegate parameter that adds a reference to a method that containsthe code that is to be executed with elevated privileges.

SPSite siteColl = SPContext.Current.Site;

SPWeb site = SPContext.Current.Web;

SPSecurity.RunWithElevatedPrivileges(delegate() {

  using (SPSite ElevatedsiteColl = new SPSite(siteColl.ID)) {

    using (SPWeb ElevatedSite = ElevatedsiteColl.OpenWeb(site.ID)) {

      string SiteCollectionOwner = ElevatedsiteColl.Owner.Name;

      string Visits = ElevatedsiteColl.Usage.Visits.ToString();

      string RootAuditEntries =

          ElevatedSite.RootFolder.Audit.GetEntries().Count.ToString();

    }

  }

});

Must read it:

In RunWithElevatedPrivileges you must then create an instance of the SPSite class and the SPWeb class. You cannot use the objects available through the Microsoft.SharePoint.SPContext.Current property. That is because those objects were created in the security context of the current user.

References:-
http://msdn.microsoft.com/en-us/library/bb466220%28v=office.12%29.aspx
http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx

Thanks!

Nikhil S.

Read More