System.UnauthorizedAccessException with SPWebpartmanager

Question

We are running SharePoint 2010 farm. I have removed all access to a sitecollection "Provider" from a user group. "Provider" is the default sitecollection that a user logs in to. We have a custom access denied page that inherits from "UnsecuredLayoutsPageBase" and has a masterpage that has spwebpartmanager.

<WebPartPages:SPWebPartManager ID="m" runat="Server" />

Now when a user from the group that does not have access to "Provider" logs in, sharepoint redirects to AccessDeniedPage. But SPWebPartManager (checked with .net reflector) throws System.UnauthorizedAccessException: Attempted to perform an unauthorized operation, as the user logged in doesn't have permissions.

Is there any way to run spwebpartmanager with elevated permissions? I couldn't find anything but the SPSecurity.RunWithElevatedPrivileges block, but that works with user code. How can i make OTB code run with elevated permissions? Any help is much appreciated. Thanks.

here is the stack trace.

System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
   at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(HttpContext context)
   at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)
   at Microsoft.SharePoint.Library.SPRequest.OpenWeb(String bstrUrl, String& pbstrServerRelativeUrl, String& pbstrTitle, String& pbstrDescription, String& pbstrTitleResourceId, String& pbstrDescriptionResourceId, Guid& pguidID, String& pbstrRequestAccessEmail, UInt32& pwebVersion, Guid& pguidScopeId, UInt32& pnAuthorID, UInt32& pnLanguage, UInt32& pnLocale, UInt16& pnTimeZone, Boolean& bTime24, Int16& pnCollation, UInt32& pnCollationLCID, Int16& pnCalendarType, Int16& pnAdjustHijriDays, Int16& pnAltCalendarType, Boolean& pbShowWeeks, Int16& pnFirstWeekOfYear, UInt32& pnFirstDayOfWeek, Int16& pnWorkDays, Int16& pnWorkDayStartHour, Int16& pnWorkDayEndHour, Int16& pnMeetingCount, Int32& plFlags, Boolean& bConnectedToPortal, String& pbstrPortalUrl, String& pbstrPortalName, Int32& plWebTemplateId, Int16& pnProvisionConfig, String& pbstrDefaultTheme, String& pbstrDefaultThemeCSSUrl, String& pbstrThemedCssFolderUrl, String& pbstrAlternateCSSUrl, String& pbstrCustomizedCssFileList, String& pbstrCustomJSUrl, String& pbstrAlternateHeaderUrl, String& pbstrMasterUrl, String& pbstrCustomMasterUrl, String& pbstrSiteLogoUrl, String& pbstrSiteLogoDescription, Object& pvarUser, Boolean& pvarIsAuditor, UInt64& ppermMask, Boolean& bUserIsSiteAdmin, Boolean& bHasUniquePerm, Guid& pguidUserInfoListID, Guid& pguidUniqueNavParent, Int32& plSiteFlags, DateTime& pdtLastContentChange, DateTime& pdtLastSecurityChange, String& pbstrWelcomePage, Boolean& pbOverwriteMUICultures, Boolean& pbMUIEnabled, String& pbstrAlternateMUICultures, Int32& puiVersion, Int16& pnClientTag)
   at Microsoft.SharePoint.SPWeb.InitWeb()
   at Microsoft.SharePoint.SPWeb.get_WebTemplate()
   at Microsoft.SharePoint.SPWeb.get_WebTemplateConfiguration()
   at Microsoft.SharePoint.WebControls.ScriptLink.InitJs_Register(Page page)
   at Microsoft.SharePoint.WebControls.ScriptLink.RegisterForControl(Control ctrl, Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language)
   at Microsoft.SharePoint.WebControls.ScriptLink.Register(Page page, String name, Boolean localizable, Boolean defer, Boolean loadAfterUI, String language, String uiVersion)
   at Microsoft.SharePoint.WebControls.ScriptLink.RegisterOnDemand(Page page, String strKey, String strFile, Boolean localizable)
   at Microsoft.SharePoint.WebControls.ScriptLink.OnLoad(EventArgs e)
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Control.LoadRecursive()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Does it work if you use an out of the box master page? Are you sure everything, including the custom master page, is checked in and published? — Rich Bennema, Nov 08 '12 at 12:57

score 0 · Answer 1 · answered Dec 13 '12 at 16:15

0

I would suggest creating a different master page without the web part manager in it.

answered Dec 13 '12 at 16:15

Senthil S

75
7

score 0 · Answer 2 · edited Jun 26 '13 at 21:31

We ran into a similar problem with a forms-based sign in page that runs when the user is not logged in.

To solve the issue, we had to switch the @Page directive from:

DynamicMasterPageFile="~masterurl/default.master"

to

MasterPageFile="~/_layouts/simple.master"

It was quite a challenge to determine the cause; had to override PrcessRequest() with a try/catch block and then look at the InnerException to get a clue what was causing the problem because in /_login/OurLoginPage.aspx it was hidden under a 403 error and only deep inside the stack trace we found the issue you talk about above.

System.UnauthorizedAccessException with SPWebpartmanager

2 Answers2