Protecting documents

[Shawn]

Hi.
I have a folder that contains a lot of different documents. xls, .doc, .pdf
etc. Different users have access to different documents. The problem is
that if a user knows the name of a document then he can just write the path
into IE and get access to it anyway. Is it possible to prevent this?

Thanks,
Shawn

 

[Jim Cheshire [MSFT]]

Shawn,

If it's required that people be able to download these (which I'm sure it
is), your best bet is to store them on the file system where they are
inaccessible directly. You can then use Response.BinaryWrite to stream
them down to the browser when legitimate.

Here's a small code sample that demonstrates a PDF file loaded both inline
and outside fo the browser.

Dim fs As New FileStream("c:\directory\books.pdf"),
FileMode.OpenOrCreate, FileAccess.Read)
Dim MyData(fs.Length) As Byte
fs.Read(MyData, 0, fs.Length)
Response.Buffer = True
Response.Clear()
Response.ContentType = "application/pdf"

' Opens it outside browser
Response.AddHeader("content-disposition", "attachment;
filename=books.pdf")

' Opens it inside browser
'Response.AddHeader("content-disposition", "inline;
filename=books.pdf")

Response.BinaryWrite(MyData)
Response.End()


Hope that helps.


Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.

--------------------

 

[S. Justin Gengo]

Shawn,

If you set the column to visible="false" you will still be able to access it
in the code-behind. If you need to access its value from the client, then
you are correct you can't set visible="false".

If the latter is the case (you need to access the value from the client
code) you could try using <div> tags around it and setting it's visibility
with CSS.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche

 

[S. Justin Gengo]

Shawn,

Sorry.

I was attempting to post to the message above yours.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche

 

[Shawn]

Didn't quite understand what column visibility had to do with protecting
document folders



Shawn,

Sorry.

I was attempting to post to the message above yours.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche

 

[Joao S Cardoso [MVP]]

You can do this 2 ways.

One, Jim's way.

The other is to srode diffrent file types in diffrent folders and then configure
diferent web.config files with the user's on each folder.

Joao Cardoso (MVP dotNET)
=======================================================
[LusoCoders]- http://groups.yahoo.com/group/lusocoders/
[PontoNetPT]- http://www.programando.net/regras.aspx
(e-mail address removed)-s.p-a.m - www.acinet.pt
=======================================================

 

[Jim Cheshire [MSFT]]

Joao,

That will work as long as the file type you are requesting is mapped to the
aspnet_isapi.dll. It's not recommended to map all of these file types to
ASP.NET.

Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.


--------------------

 

[Joao S Cardoso [MVP]]

Joao,

That will work as long as the file type you are requesting is mapped to the
aspnet_isapi.dll. It's not recommended to map all of these file types to
ASP.NET.

Hi... ur right...

I just remember something... if he is using windows authentication perhaps is as
easy as changing the security settings for diffrent folders....

But still your way seems that will be the best for this scenario.

Joao Cardoso (MVP dotNET)
=======================================================
[LusoCoders]- http://groups.yahoo.com/group/lusocoders/
[PontoNetPT]- http://www.programando.net/regras.aspx
(e-mail address removed)-s.p-a.m - www.acinet.pt
=======================================================