Using OpenTextFile when IUSR doesn't have Write permission

Discussion in 'ASP General' started by Andyza, Sep 30, 2009.

  1. Andyza

    Andyza Guest

    I'm using code similar to the code below to write to a text file on my
    web server (IIS 6 & Win2k3).

    strFileName = Server.Mappath("Test.txt")
    Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.OpenTextFile(strFileName,8,True)
    objFile.WriteLine "Hello World"
    objFile.Close
    Set objFile = nothing
    Set objFSO = nothing

    In order for thsi script to work the Internet Guest account (IUSR)
    needs to have Write permissions. For obvious security reasons we don't
    really want to allow this. Apart form giving IUSR write access, is
    there any other way get the script to be able to write to the text
    file?

    Thanks
     
    Andyza, Sep 30, 2009
    #1
    1. Advertisements

  2. Andyza

    Bob Barrows Guest

    Cause the code to run under a different security context? In IIS, you
    could do this by using impersonation. But the effect would be the same,
    really. If you are doing this in ASP server-side code then the same
    security hole would be opened. All you can really do is mitigate the
    potential damage by only assigning Write permissions for a specific
    folder.
     
    Bob Barrows, Sep 30, 2009
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.