Permissions when Accessing SPFiles

A couple of weeks ago I needed to build some functionality into a SharePoint site to force PDF files to prompt the user to open or download instead of automatically opening in the browser. I built all the functionality and used SPWeb.Folders.File to access the document and then used a Response.Write to output the file as an attachment. I tested it both logged in (and I thought as an anonymous user) and everything seemed to be working well.



When it comes to an anonymous SharePoint site it is sometimes hard to build custom code on top of the platform because you need to include RunWithElevatedPrivileges when you need to update or add files to lists or libraries.



The client contacted me the other day to say that users hitting the Web site were being prompted for a username and password when they tried to download the PDF file. So being the diligent SP dev that I am, I started looking at the code and commenting out lines until I found where the issue lied. The entire time in the back of my mind I was thinking it had to be an issue where I will need to run the code as elevated.



What I finally found was that the SPWeb.Folders.Files call was the one that was prompting users to log in. To remedy this I thought about another method call that I had used before, SPWeb.GetFile() and couldn't think why I had used the Folders.Files method this time. So I tried SPWeb.GetFile() and the code worked perfectly. No login prompts when hitting the call from an anonymous user. Apparently the method call has enough permissions to open files but accessing the Files property of the SPFolder object does not have enough permissions.



Just another thing to look out for when building a custom SP solution.