Check access rights programmatically for scheduled task

Question

I have a scheduled task in Sitecore. In the task I need run the code, that send notification to all users that have access to specific WorkFlow state.

I got list of all users under sitecore domain and check users rights to workflow state item, but I always get "true". Looks like Security doesn't work.

My function:

private List<string> GetUserEmailsInCurrentWorkflowState(WorkflowState state)
{
    List<string> emails = new List<string>();
    var stateItem = this.master.GetItem(state.StateID);
    foreach (var user in UserList.Where(x => x.IsAdministrator == false).ToList())
    {
        if (AuthorizationManager.IsAllowed(stateItem, AccessRight.WorkflowStateWrite, user) &&
                AuthorizationManager.IsAllowed(stateItem, AccessRight.WorkflowCommandExecute, user))
         {
            if (!string.IsNullOrEmpty(user.Profile.Email))
            {
                emails.Add(user.Profile.Email);
            }
          }
     }
        return emails;
    }
}

And I tried switch context site (by default it "scheduler") and context user:

private List<string> GetUserEmailsInCurrentWorkflowState(WorkflowState state)
    {
        List<string> emails = new List<string>();
        var stateItem = this.master.GetItem(state.StateID);
        foreach (var user in UserList.Where(x => x.IsAdministrator == false).ToList())
        {
            var website = Sitecore.Configuration.Factory.GetSite("website");
            using (new SiteContextSwitcher(website))
            {
                Item item;
                using (new Sitecore.Security.Accounts.UserSwitcher(user))
                {
                    item = master.GetItem(new ID(state.StateID));
                }
                if (item != null)
                {
                    if (AuthorizationManager.IsAllowed(stateItem, AccessRight.WorkflowStateWrite, user) &&
                        AuthorizationManager.IsAllowed(stateItem, AccessRight.WorkflowCommandExecute, user))
                    {
                        if (!string.IsNullOrEmpty(user.Profile.Email))
                        {
                            emails.Add(user.Profile.Email);
                        }
                    }
                }
            }
        }
        return emails;
    }

I tested the code under website and it worked.

What are the features of Security for scheduled tasks in Sitecore? How I can check access right of user to item in my task?

Answer 1

I think tasks are executed within a SecurityDisabler, which would explain the behavior you're seeing. Within your site the code works, but within a SecurityDisabler all rights will be "true".

You can try to fix this with a SecurityStateSwitcher:

using (new SecurityStateSwitcher(SecurityState.Enabled))
{
  ...
}