3

In a Web 8.5 system, event system is reading a Component by WebDavUrl. It then tries to access the Component's WebDavUrl property and it fails with security exception in the Event Log.

This only happens when the user is not an administrator. The same code runs fine if user is administrator.

You do not have permission to perform this action.

Component: Tridion.ContentManager
Errorcode: 578
User: NT AUTHORITY\NETWORK SERVICE

StackTrace Information Details:
   at Tridion.ContentManager.ContentManagement.VersionedItem.OnLoaded(LoadEventArgs eventArgs)
   at Tridion.ContentManager.ContentManagement.Component.OnLoaded(LoadEventArgs eventArgs)
   at Tridion.ContentManager.IdentifiableObject.Load(LoadFlags flags, Boolean forceReload)
   at Tridion.ContentManager.ContentManagement.VersionedItem.Load(LoadFlags flags, Boolean forceReload)
   at Tridion.ContentManager.IdentifiableObject.Reload()
   at Tridion.ContentManager.ContentManagement.RepositoryLocalObject.get_WebDavUrl()
   ...

The event system code is as follows:

var session = component.Session;
var c = session.GetObject(HttpUtility.UrlPathEncode(webDav)) as Component;
string path = c.WebDavUrl;

This all happens inside when subscribed to event:

EventSystem.Subscribe<Component, PublishEventArgs>(OnCompletePublishComponent, EventPhases.TransactionCommitted);

I can't figure out why this is an issue and why it works for administrator. Does anybody have any thoughts? Workarounds?

I'm thinking maybe the Session is wrong? But it's the one inherited from event system context and I think it's using the CoreService behind the scene... or maybe it should use it?

NETWORK SERVICE is an impersonation user.

Maybe it's a bug?

3

As can be seen in the Stack Trace, accessing the WebDavUrl property triggers a load of the Component (this is expected), but you don’t get through the security check.

In order to read/load a Component, the user must have Publication Access Rights and Read Permissions on the Folder containing the Component. It seems this is not the case.

It makes sense that it does work if the user has SysAdmin privileges.

|improve this answer|||||
  • I am able to open that Component in the CME using the user in question. That's what I find weird... Any thoughts? I'll check some more anyway – Mihai Cădariu Sep 22 '18 at 14:59
  • Answer is correct! I was opening the wrong Component in the CME – Mihai Cădariu Sep 24 '18 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.