1

I have a configuration Component in the Gloabal/Shared publication, We have Event System code which reads this Configuration Component using current component session, but in case if the current user does not have access to the Shared publication then Event System fails. i saw this post to ElevatePrivilages to sysadmin,and also gone through this post and the code is below

using (ElevatedPrivilegesScope scope = new ElevatedPrivilegesScope(nonAdminSession, Privileges.SysAdmin))
{
    // Do your admin tasks
}

but i am afraid to use it as we have nlb in prod , if in any case any server gets down(in case of some outage or xyz reason) and at the same time when the event is triggered and somehow RestorePrivileges does not execute then the normal user will has all the privileges as admin an will start experiencing new cme with all the access of publications? please correct me if i am wrong.

Improve this question
4
  • 1
    Privilege Elevation is only applicable to the session you are creating, not for other sessions. The use case is really for when you need to do something programmatically that the user cannot do - but you still want to make sure it's traceable back to this user.
    – Nuno Linhares ♦
    Commented Feb 19, 2020 at 17:04
  • Thanks @NunoLinhares for your comments, we have image size checker event system code which basically restrict Content editors to add high size images, this image configuration component we are reading in Event system using current component session, but as i said this fails if the Content editor does not have access to the publication where the configuration component resides. If privileges does not revoke for some reasons then the same user will not see the all publication in the CME? (As he is in the same session and cme is accessible because one of the pro cme node is still up?)
    – Neelesh Raghuvanshi
    Commented Feb 19, 2020 at 17:16
  • 1
    Sorry, apparently it wasn't clear. You are not elevating the user's privilege, you are elevating the Session privilege. User is not in the same session, if he logs in via CME, the user is using a different session.
    – Nuno Linhares ♦
    Commented Feb 20, 2020 at 8:20
  • Thanks @NunoLinhares for your help,
    – Neelesh Raghuvanshi
    Commented Feb 20, 2020 at 9:58

1 Answer 1

Reset to default
4

What you are worried about -- the user somehow being left as an administrator - will not happen when you use ElevatedPrivilegesScope.

The elevation only applies to the scope, not to the user, so even if your code throws an exception afterwards there is no harm done. Heck, even if the user does actions while your code is running, they are not able to do anything other than what their normal permissions allow. Because again, it's not that the user's permissions are temporarily increased -- it's more that your code will do actions on behalf of the user without having to be constrained by their permissions.

Improve this answer
1
  • Thanks @peter for this information , it clears my doubt :)
    – Neelesh Raghuvanshi
    Commented Feb 20, 2020 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.