Change file summary (title, author, etc.)

[Guest]

Hello,

I am having some sort of security issue with my code. When I change a
file's title in a Windows or console app, I have no problems. (I am using
Microsoft's article & DsoFile.dll:
http://support.microsoft.com/default.aspx?scid=kb;en-us;224351)

When I run it in ASP.NET, I get a "file not found" exception, even though
the file does exist.

Here is what I have already tried within ASP.NET:
1. Launch the code in a console app in a separate process.
2. Launch the code as a web service...didn't think this would work since
it's under IIS's jurisdiction as well, but tried anyway.
3. Both of the above two options while impersonating an admin account.
4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly
in my solution).

Here is my code:

Dim oSummProps As DSOFile.SummaryProperties
Dim oCustProp As DSOFile.CustomProperty
Dim sFile, sTmp As String
Dim m_oDocument As DSOFile.OleDocumentPropertiesClass

m_oDocument = New DSOFile.OleDocumentPropertiesClass
' Note: fileName is just a local file...in this case, c:\test.txt.
m_oDocument.Open(fileName, False, _
DSOFile.dsoFileOpenOptions.dsoOptionOpenReadOnlyIfNoWriteAccess)

If Not m_oDocument.IsReadOnly Then
oSummProps = m_oDocument.SummaryProperties
oSummProps.Title = myNewTitle
m_oDocument.Save()
End If
m_oDocument.Close()
m_oDocument = Nothing

Does anybody know what to do here?

Thank you!

Eric

 

[Patrice]

Likely permissions. See under whihc account runs your app and give this
account the appropriate rights or use another directory...

A tool such as filemon from www.sysinternals.com may help to diagnose file
access problmes in case your configuration should work but still fails...

 

[Paul Clement]

¤ Hello,
¤
¤ I am having some sort of security issue with my code. When I change a
¤ file's title in a Windows or console app, I have no problems. (I am using
¤ Microsoft's article & DsoFile.dll:
¤ http://support.microsoft.com/default.aspx?scid=kb;en-us;224351)
¤
¤ When I run it in ASP.NET, I get a "file not found" exception, even though
¤ the file does exist.
¤
¤ Here is what I have already tried within ASP.NET:
¤ 1. Launch the code in a console app in a separate process.
¤ 2. Launch the code as a web service...didn't think this would work since
¤ it's under IIS's jurisdiction as well, but tried anyway.
¤ 3. Both of the above two options while impersonating an admin account.
¤ 4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly
¤ in my solution).
¤
¤ Here is my code:
¤
¤ Dim oSummProps As DSOFile.SummaryProperties
¤ Dim oCustProp As DSOFile.CustomProperty
¤ Dim sFile, sTmp As String
¤ Dim m_oDocument As DSOFile.OleDocumentPropertiesClass
¤
¤ m_oDocument = New DSOFile.OleDocumentPropertiesClass
¤ ' Note: fileName is just a local file...in this case, c:\test.txt.
¤ m_oDocument.Open(fileName, False, _
¤ DSOFile.dsoFileOpenOptions.dsoOptionOpenReadOnlyIfNoWriteAccess)
¤
¤ If Not m_oDocument.IsReadOnly Then
¤ oSummProps = m_oDocument.SummaryProperties
¤ oSummProps.Title = myNewTitle
¤ m_oDocument.Save()
¤ End If
¤ m_oDocument.Close()
¤ m_oDocument = Nothing
¤
¤ Does anybody know what to do here?

I would agree that there is a permissions problem. It isn't clear though where these files are
located or how you have implemented impersonation in your web application.


Paul
~~~~
Microsoft MVP (Visual Basic)

 

[Guest]

Thank you for your replies, Patrice and Paul.

I think you two nudged me a little in the right direction...not quite there
yet, but close. I explicitly set the NTFS permissions on the directory to
allow the ASPNET account full access. Now, instead of the "file not found"
exception, I get "System.UnauthorizedAccessExcep­tion: Access is denied." on
the following line of code:

oSummProps.Title = myNewTitle

Therefore, I was able to open the file, and it was not read-only. (If you
don't have read/write access, it still opens the file as read-only.)

And Patrice, I took your advice with the filemon...it shows a successful
CREATE request and a successful CLOSE request. Unfortunately, the attempt to
set the title in the line of code above is not logged.

Also, I took the advice of Ken Cox (http://tinyurl.com/7sleo) to change the
ASPNET account from machine to SYSTEM, but that didn't seem to have any
greater effect.

Any other ideas?

Thanks again!

Eric

 

[Paul Clement]

¤ Thank you for your replies, Patrice and Paul.
¤
¤ I think you two nudged me a little in the right direction...not quite there
¤ yet, but close. I explicitly set the NTFS permissions on the directory to
¤ allow the ASPNET account full access. Now, instead of the "file not found"
¤ exception, I get "System.UnauthorizedAccessExcep­tion: Access is denied." on
¤ the following line of code:
¤
¤ oSummProps.Title = myNewTitle
¤
¤ Therefore, I was able to open the file, and it was not read-only. (If you
¤ don't have read/write access, it still opens the file as read-only.)
¤
¤ And Patrice, I took your advice with the filemon...it shows a successful
¤ CREATE request and a successful CLOSE request. Unfortunately, the attempt to
¤ set the title in the line of code above is not logged.
¤
¤ Also, I took the advice of Ken Cox (http://tinyurl.com/7sleo) to change the
¤ ASPNET account from machine to SYSTEM, but that didn't seem to have any
¤ greater effect.
¤
¤ Any other ideas?

OK, well I have same two questions as in my prior reply but I will be more specific. ;-)

How did you implement impersonation? Did you enable the option in web.config? Are you impersonating
the authenticated user (via Integrated Windows or Basic auth)?

Where are the files located? Are they on the web server or a remote network machine?


Paul
~~~~
Microsoft MVP (Visual Basic)