How to elevate permission in JSON code to get permission to do Add/Edit/Update operation on SharePoint list? (similar to RunWithElevatedPriviledges in SSOM). If elevation is not possible then my question is how to do Add/Edit/Update/Delete operation on a list access to which is highly restricted and which can be accessed only by senior managers?

• Edited by User2278 Sunday, August 23, 2015 4:59 AM

Hi,

Not any type of client object model does support SPSecurity.RunWithElevatedPrivileges.

Because our code runs on the client, the identity cannot be reverted to the application pool account and running code as system account via the client object model would open a big security hole and then everybody could write and execute code as an administrator and can do anything delete or update. To achieve this kind of operation you can develop a custom web service or WCF service on the server which run the code in SPSecurity.RunWithElevatedPrivilege() method and then you host this service to your SP Server then call the web service from the client object model or JSON

Another possible way is to develop a custom web service on the server which run the code in RunWithElevatedPrivilege() method and then call the web service from the client object model.

How to Create WCF Web Service on SharePoint 2010

Even we cant do like below example we do in SharePoint Server object model so execute the code under the admin user like below.

var user = SPContext.Current.Web.AllUsers[@"SHAREPOINT\SYSTEM"];

 var superToken = user.UserToken;

 using (var site = new SPSite(SPContext.Current.Web.Url, superToken))

 {

    // This code runs under the security context of the SHAREPOINT\system

 // for all objects accessed through the "site" reference. Note that it's a

 // different reference than SPContext.Current.Site.

    using(var elevatedWeb = site.OpenWeb())

    {

       // Perform actions as SYSTEM here

    }

 }