Security exception when reading WebDavUrl

Question

In a Web 8.5 system, event system is reading a Component by WebDavUrl. It then tries to access the Component's WebDavUrl property and it fails with security exception in the Event Log.

This only happens when the user is not an administrator. The same code runs fine if user is administrator.

You do not have permission to perform this action.

Component: Tridion.ContentManager
Errorcode: 578
User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details:
   at Tridion.ContentManager.ContentManagement.VersionedItem.OnLoaded(LoadEventArgs eventArgs)
   at Tridion.ContentManager.ContentManagement.Component.OnLoaded(LoadEventArgs eventArgs)
   at Tridion.ContentManager.IdentifiableObject.Load(LoadFlags flags, Boolean forceReload)
   at Tridion.ContentManager.ContentManagement.VersionedItem.Load(LoadFlags flags, Boolean forceReload)
   at Tridion.ContentManager.IdentifiableObject.Reload()
   at Tridion.ContentManager.ContentManagement.RepositoryLocalObject.get_WebDavUrl()
   ...

The event system code is as follows:

var session = component.Session;
var c = session.GetObject(HttpUtility.UrlPathEncode(webDav)) as Component;
string path = c.WebDavUrl;

This all happens inside when subscribed to event:

EventSystem.Subscribe<Component, PublishEventArgs>(OnCompletePublishComponent, EventPhases.TransactionCommitted);

I can't figure out why this is an issue and why it works for administrator. Does anybody have any thoughts? Workarounds?

I'm thinking maybe the Session is wrong? But it's the one inherited from event system context and I think it's using the CoreService behind the scene... or maybe it should use it?

NETWORK SERVICE is an impersonation user.

Maybe it's a bug?

Answer 1

As can be seen in the Stack Trace, accessing the WebDavUrl property triggers a load of the Component (this is expected), but you don’t get through the security check.

In order to read/load a Component, the user must have Publication Access Rights and Read Permissions on the Folder containing the Component. It seems this is not the case.

It makes sense that it does work if the user has SysAdmin privileges.