Web.sitemap and Flash

[JJ]

Although this question involves Flash, I suspect the actual issue is an asp
one..

I am trying to open the web.sitemap file in an .swf file enbedded in an asp
page (I'm working in VS 2005).

I get an error in Flash when it trys to open this file using standard Flash
commands. However when I change the file name and command to 'Web.xml'
it works. (it also works if I don't change the name, but run the swf in
flash player and not via the browser/web server)
I suspect therefore that this is a result of the browser not knowing what a
'.sitemap' file is???

So, how do I open an xml file called 'Web.sitemap' in a web page with an
embedded .swf???? Would anyone advise changing the suffix of the web.sitemap
file?

JJ

 

[Shimon Sim]

I think that the reason is that ASP.NET protects some files from direct
access and sitemap is one of them.
Usually you don't want user to see this file directly.
xml files by default are not protected so you can view it from client.

To change sitemap to xml or not is your decision. If it is OK if user just
enters your sitemap file in browser and views it then you can change it. If
it is not OK then you should decide if you want flash to use this file.
Good luck
Shimon.

 

[JJ]

When is it not ok for a user to see the sitemap file?

I managed to use a handler to allow the sitemap file to be viewed. However,
I am confused as to why Microsoft see this as a security issue. Most sites
seem to use a viewable XML sitemap??
JJ

 

[Juan T. Llibre]

re:

I think that the reason is that ASP.NET protects some files from direct access and sitemap is one
of them.

That is correct.

re:

Would anyone advise changing the suffix of the web.sitemap file?

If the .sitemap is being used by an ASP.NET application,
renaming the sitemap file will make it unavailable to the app.

Would *copying* the web.sitemap file to "web.xml" work ?

 

[JJ]

I ended up using a handler to allow read access to the web.sitemap file.

When I then tell flash to use the handler in stead of the web.sitemap file
directly, it works.

I cannot think of how this could cause a security problem?? Neither can I
see how allowing read access to the web.sitemap file directly could cause a
security problem...???

 

[JJ]

I have realised now what the security problem is....
If I use roles to all/deny access to certain files/directories these will be
openly displayed in the web.sitemap file.

As I probably am going to do this, I see this as the only approach to get
Flash to diplay menu's based on the web.sitemap contents.:

i) Make the web.sitemap handler secure so that only the swf file can access
it (how..???)
ii) Program flash to read the handler output, and read a parameter that
indicates the current user role;
iii) Get flash to only display menu items that the current role is allowed
to see.

Item (i) is the real tricky one here....any ideas....??