Why i cannot write a file, even i add a permission to that file.

Discussion in 'ASP .Net Security' started by Umut Tezduyar, Nov 12, 2004.

  1. My web site user should change some files in the root folder. Why the
    following code is not working.
    I dont want to manually give permission for the asp.net account for each
    file. Instead, i want to give permission that the caller can write to the
    specified file.
    I have investigated the msdn and web. Is this information is hidden ?? Can
    any one help me about this.

    string path = System.Web.HttpContext.Current.Server.MapPath(string.Empty) +
    @"\";

    string file = path + this.insertedcontrolName;

    // Enable write permission for the file.

    FileIOPermission fileIOPerm1 = new
    FileIOPermission(FileIOPermissionAccess.AllAccess, file);

    fileIOPerm1.AddPathList(FileIOPermissionAccess.Write, path);

    fileIOPerm1.AddPathList(FileIOPermissionAccess.Read, path);

    fileIOPerm1.Assert ();

    // Writing to the file

    TextWriter writer = new System.IO.StreamWriter (file, false,
    System.Text.Encoding.UTF8);

    writer.Write (this.html);

    writer.Close ();
    Umut Tezduyar, Nov 12, 2004
    #1
    1. Advertising

  2. Hi Umut,

    Thanks for your posting. As for the file permission problem you mentioned,
    are you got the "Access denied" error? In fact, this problem is caused by
    the windows's file access premission rather than the .NET's CAS. So setting
    the

    FileIOPermission fileIOPerm1 = new
    FileIOPermission(FileIOPermissionAccess.AllAccess, file);

    is not necessary. We need to grant the NTFS's file access permission(
    write/modify) of that file to the asp.net 's worker process account( the
    machine\aspnet on WIN2K IIS 5 or the NetworkService on win2k3 iis6). After
    that, you can get your page write/modify the file correctly.

    Hope helps. If you still have anything unclear, please feel free to post
    here. Thanks.'

    Regards,

    Steven Cheng
    Microsoft Online Support

    Get Secure! www.microsoft.com/security
    (This posting is provided "AS IS", with no warranties, and confers no
    rights.)
    Steven Cheng[MSFT], Nov 13, 2004
    #2
    1. Advertising

  3. This is not solving my problem. I have developed a control and i want my
    control to write some files in the web applications root.
    Do i have to inform users, which will use my control, as add, a permission
    to the each file that my application will use.
    What if my user deploys its web site with my control to a server that he
    cannot change the permission of the files.


    "Steven Cheng[MSFT]" <> wrote in message
    news:%...
    > Hi Umut,
    >
    > Thanks for your posting. As for the file permission problem you mentioned,
    > are you got the "Access denied" error? In fact, this problem is caused by
    > the windows's file access premission rather than the .NET's CAS. So
    > setting
    > the
    >
    > FileIOPermission fileIOPerm1 = new
    > FileIOPermission(FileIOPermissionAccess.AllAccess, file);
    >
    > is not necessary. We need to grant the NTFS's file access permission(
    > write/modify) of that file to the asp.net 's worker process account( the
    > machine\aspnet on WIN2K IIS 5 or the NetworkService on win2k3 iis6). After
    > that, you can get your page write/modify the file correctly.
    >
    > Hope helps. If you still have anything unclear, please feel free to post
    > here. Thanks.'
    >
    > Regards,
    >
    > Steven Cheng
    > Microsoft Online Support
    >
    > Get Secure! www.microsoft.com/security
    > (This posting is provided "AS IS", with no warranties, and confers no
    > rights.)
    >
    >
    >
    >
    Umut Tezduyar, Nov 13, 2004
    #3
  4. Hi Umut,

    Thanks for your response. The problem is that the file access protection is
    the buildin security protection of the NTFS FILE SYSTEM. If you do want to
    provide such permission for multi-user controls, one possbile approach is
    to add a sub folder under the web application's root folder ( the VIRUTAL
    DIR) and grant the write/modify permission of that folder to the asp.net
    worker process account. Then we can put all your usercontrols that need
    modify under that sub folder.

    BTW, I still recommend that we don't modify the page or usercontrol's
    source( aspx or ascx or code behind) at runtime. Because the web
    application has the "numRecompilesBeforeAppRestart" setting which indicate
    that the web app will be restarted when the number of the asp.net component
    files be modified and recompiled has exceed this value, see the following
    doc:

    #<compilation> Element
    http://msdn.microsoft.com/library/en-us/cpgenref/html/gngrfCompilationSectio
    n.asp?frame=true

    So, I don't think modify the page/usercontrol source is a good means. Would
    you consider putting the UserControl's UI change logic into the control's
    code so as to make it output different content at runtime? For example, use
    some properties to control the UserControl's output and we can set such
    properties in Usercontrol's construct. If you have any other ideas or
    concerns , please feel free to post here. Thanks.

    Regards,

    Steven Cheng
    Microsoft Online Support

    Get Secure! www.microsoft.com/security
    (This posting is provided "AS IS", with no warranties, and confers no
    rights.)
    Steven Cheng[MSFT], Nov 15, 2004
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Stan Goodman

    Even older fart, even newer newbie

    Stan Goodman, Jul 3, 2003, in forum: Java
    Replies:
    11
    Views:
    676
    Stan Goodman
    Jul 4, 2003
  2. Marcia Hon
    Replies:
    0
    Views:
    440
    Marcia Hon
    Feb 8, 2004
  3. Mr. SweatyFinger

    why why why why why

    Mr. SweatyFinger, Nov 28, 2006, in forum: ASP .Net
    Replies:
    4
    Views:
    853
    Mark Rae
    Dec 21, 2006
  4. Mr. SweatyFinger
    Replies:
    2
    Views:
    1,736
    Smokey Grindel
    Dec 2, 2006
  5. Swathika
    Replies:
    1
    Views:
    355
    Danno
    Jun 23, 2008
Loading...

Share This Page