Sharepoint Webpart Security Exception

Question

I have a custom sharepoint web part that is throwing the following exception:

System.Security.SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed.
   at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
   at Waverly.SharePoint.Features.WebParts.SearchesListWebPart.Render(HtmlTextWriter writer)
The action that failed was:
Demand
The type of the first permission that failed was:
Microsoft.SharePoint.Security.SharePointPermission
The Zone of the assembly that failed was:
MyComputer

My theory is that Sharepoint does not have the trust level to run the web part but I'm having difficulty figuring out how to debug this problem. Anyone have any experience debugging something like this?

Solution 1

There are several options you have. The first is to install your assembly into the GAC. It will then get full trust, but you have to install it in the GAC, strong name it, etc. The second option is to go into the web.config and add it to the trusted list. This article and this one will help you get down that path.

The third option is to drop your assembly in the C:\inetpub\wwwroot\wss\VirtualDirectories[port]_app_bin folder. This is set in the global SharePoint config to fully trust any assemblies in there. You might want to try that first just to see if it helps, and if so, use one of the other two methods (since technically that's an undocumented feature and could be changed)

EDIT: Ok, there's a couple of things you can try. Try bumping up the overall trust level as shown in this article. Basically look for:

<trust level="Full" originUrl="" />

If that works, then it indicates that you are relying on a DLL that isn't trusted. Note that you don't want to leave it with trust level Full, since that means any webpart has full trust.

Does that help?

Solution 2

It is crazy. I can't execute the following line in a web part:

using (SPSite site = new SPSite(parentWebUrl))

However i can execute it not using web parts.

It throws me a similar exception althought the DLL is in the GAC plus are added to safecontrols.

Exception: SecurityException
Message: Request failed.
Action: System.Security.Permissions.SecurityAction.Demand
Some stack trace:
    at Microsoft.SharePoint.SPWeb.SPWebConstructor(SPSite site, String url, Boolean bExactWebUrl, SPRequest request)
    at Microsoft.SharePoint.SPWeb..ctor(SPSite site, String url, Boolean bExactWebUrl)
    at Microsoft.SharePoint.SPSite.OpenWeb()
    at ....

It also sais that

((System.Security.SecurityException)($exception)).Demanded
((System.Security.SecurityException)($exception)).DenySetInstance
((System.Security.SecurityException)($exception)).FailedAssemblyInfo
((System.Security.SecurityException)($exception)).FirstPermissionThatFailed
((System.Security.SecurityException)($exception)).GrantedSet

threw an exception.

What is the problem with that?

Solution

It turns out that many times errors like thses occur because various actions happen in webpart constructor. You almost cannot interact with SharePoint object model there.

Move code somwhere else and it could work. I moved my code to CreateChildControls and it worked.