In a Web 8.5 system, event system is reading a Component by WebDavUrl. It then tries to access the Component's WebDavUrl property and it fails with security exception in the Event Log.
This only happens when the user is not an administrator. The same code runs fine if user is administrator.
You do not have permission to perform this action. Component: Tridion.ContentManager Errorcode: 578 User: NT AUTHORITY\NETWORK SERVICE StackTrace Information Details: at Tridion.ContentManager.ContentManagement.VersionedItem.OnLoaded(LoadEventArgs eventArgs) at Tridion.ContentManager.ContentManagement.Component.OnLoaded(LoadEventArgs eventArgs) at Tridion.ContentManager.IdentifiableObject.Load(LoadFlags flags, Boolean forceReload) at Tridion.ContentManager.ContentManagement.VersionedItem.Load(LoadFlags flags, Boolean forceReload) at Tridion.ContentManager.IdentifiableObject.Reload() at Tridion.ContentManager.ContentManagement.RepositoryLocalObject.get_WebDavUrl() ...
The event system code is as follows:
var session = component.Session; var c = session.GetObject(HttpUtility.UrlPathEncode(webDav)) as Component; string path = c.WebDavUrl;
This all happens inside when subscribed to event:
EventSystem.Subscribe<Component, PublishEventArgs>(OnCompletePublishComponent, EventPhases.TransactionCommitted);
I can't figure out why this is an issue and why it works for administrator. Does anybody have any thoughts? Workarounds?
I'm thinking maybe the Session is wrong? But it's the one inherited from event system context and I think it's using the CoreService behind the scene... or maybe it should use it?
NETWORK SERVICE is an impersonation user.
Maybe it's a bug?