FTP via ASP without using components 1

[estellemorris]

I have found a solution but having problems with permissions on my shared web server.

Here is a snippet of my ASP page.

CODE
Dim fso, TF, DataFileName
DataFileName = "c:\SAMPLE.TXT"
FTPFileName = "C:\CMDS.FTP"

Set fso = CreateObject("Scripting.FileSystemObject")
Set TF = fso.CreateTextFile(DataFileName , True)
TF.WriteLine("SOME TEXT DATA")
TF.close

'FTP Text file to Server
Set TF = fso.CreateTextFile(FTPfilename, True)

TF.WriteLine("open <SERVER>")
TF.WriteLine("USER")
TF.WriteLine("PASSWORD")
TF.WriteLine("cd /dropdir")
TF.WriteLine(" put " & DataFileName )
TF.WriteLine(" quit ")

TF.CLOSE

Set objShell = CreateObject("Wscript.Shell")
FtpCommand = "FTP -s:" & FTPfilename & " -i -d "
objShell.Run FTPCommand


This method fails with a "VBscript Runtime error '800a0046' Permission denied" at the line objShell.Run FTPCommand when I run it from my website.

Any advice ?

Thanks

 

[Tarwn]

I believe if your using anonymous permissions then your generic web user (IUSR_Machinename) needs execute permissions in that folder as well as execute permissions on cmd.exe in System32 and possibly on the FTP executable, wherever it is.

 

[estellemorris]

I feared that that would be the case. I am using shared hosting so have no access to the System32 amd FTP executable. I don't presume that there would be anyway of bypassing this?

 

[theniteowl]

You are also trying to create your files in the root of the C drive which is never going to be allowed on the server.
It might not be a problem running ftp it might be that you try and read/write from a folder you do not have access to.

I THINK that if you have access to run the shell then you do not have to worry about FTP or CMD as the shell runs in a different security context than IUSR_machinename.

Test this by running this bit of code from the web server.
It uses the shell to execute a ping and echo the results back to the screen. If it works then you have shell access.

<% Response.Buffer = true %> 
<% 
    url = "[URL unfurl="true"]www.espn.com"[/URL] 
    Set objWShell = CreateObject("WScript.Shell") 
    Set objCmd = objWShell.Exec("ping " & url) 
    strPResult = objCmd.StdOut.Readall() 
    set objCmd = nothing: Set objWShell = nothing 
    strStatus = "offline" 
    if InStr(strPResult,"TTL=")>0 then strStatus = "online" 
    response.write url & " is " & strStatus 
    response.write ".<br>" & replace(strPResult,vbCrLf,"<br>") 
%>

If it works then alter your code to use the current web folder to create your .txt and .ftp files and use a fully qualified path to those files when you call ftp.exe, not a relative path.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[estellemorris]

Thanks for that. I have tried to run the code but I'm told that access is denied

 

[theniteowl]

Then you do not have access to run WScript.Shell.
You can ask the provider to open up access or if they provide any server-side objects to do FTP with. It is possible they have something in place for that purpose.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[Sheco]

ok, supposing that everything worked... what would you have?

A page that moved a file from the web server to another 3rd server? How is that useful?

As a user I would need to upload the file to the web server first and then use the web server to move it to the 3rd server... why not go directly to that other box?

 

[estellemorris]

Sheco, the code snippet included was just an example to see if acces was possible. This is not the final code. The final code enables upload from my client server to the web server, but without access to Wscript.Shell it isn't possible anyway. Thanks theniteowl useful ping code.

 

[theniteowl]

Is the client server a web server also?
What type of access do you have on that end?

You need access to Shell on the sending machine not on the receiving machine. The receiving machine just needs to have FTP enabled for you to send to it.

Where does the file come from?
Is it an automated or manual process?
If manual can you use a file upload script rather than FTP?

Detail the circumstances and perhaps we can suggest alternatives.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[estellemorris]

OK, I am trying to setup a script that would allow partners in Europe to upload large (20Mb) files to my website across the web. My hosting company only allows a maximum of 4Mb upload usign upload script, hence I was trying to create an FTP script that would be faster and not restricted to 4Mb

 

[theniteowl]

You could use a VBS or .HTA on the client's PC to perform the FTP from the clients PC or put the file out on a file server in their own office and give them links to it.

It all depends on how automated the process is. Do they browse to and select the file or will it always be the same named file in the same location?

Also, you have to have access on the web server to FTP the files in which you probably do but your host may get upset with you if you start passing a lot of large files through their server via FTP.

As for your hosting company, if they only allow 4MB through file upload then it must be through their own scripts. If you setup your own script you may not have the limitation though your bandwidth usage will go up and you may end up with problems on that end.

I have a VBS file for FTPing a file from a PC to an FTP site or it can be easily altered to become a .HTA file so you can give it some HTML formatting but still have the ability to run the code with client-side privledges. Either way it would have to run on the client's PC or from a local file-server they have access to.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[Sheco]

So these people are your partners not just random internet users... they probably trust you more than just some joe schmoe... Maybe you could make a little HTA for them?

 

[estellemorris]

Thanks for that, the problem is, we're talking multiple partners and not always on the same PC, + most of them do not want us to install any script on their PCs, so we're talking automated. I have tried our own script for uploading files but it still times out even though I have increased the timeout option. Our host suggested ASPUpload but that's also limited to 4Mb

 

[theniteowl]

You will not have to install the vbs or .hta file they are just stand alone files. They can reside either on the persons desktop or as I said, on a file server they all have access to.

The FTP process no matter what you do is going to rely on code on the client's PC as FTP.exe has to execute from the client's PC in order to send to your web server. Otherwise the clients have to copy the file to another machine and cause FTP.exe to be executed from that machine. One way or another though they MUST have code on one of their devices in order to do the FTP.

One less elegant possibility is your client using Internet Explorer to connect directly to your web server using it's FTP address like: ftp://

http://www.myserver.com

and it would prompt for the ID and Password then they can copy the file to the folder the same way they do in Windows Explorer.

For the web upload the maximum timeout is set on the server so no matter what you set the timeout to in your code you cannot exceed the server-defined maximum.
I do not see how your hosting company would set a file size limit on uploads using an ASP script other than limiting the timeout to the page so it could never get very far into a large upload before it failed.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[estellemorris]

we've tried the 'less elegant' option but our partners founf it very difficult to use, especially as the file name they uploaded then had to be copied and pasted to a database update system manually (as opposed to the automatic naming that came with our upload script) hence we are trying to automate it as much as possible. I would think that all our partners would have ftp.exe unabled on their PCs so this should work.

 

[theniteowl]

They probably do have ftp.exe but you have to execute it with client-side permissions which means local code not web based. You might be able to get ActiveX to do your file creation on the client's PC then execute ftp.exe from there but it still requires the creation of a file on their system and will prompt them with an ActiveX warning they have to approve through before it runs.

If their PCs are locked down at all then cmd.exe may not be accessible to them or the wshom.ocx file may have been un-registered which will prevent the FTP from executing.


It's hard to think outside the box when I'm trapped in a cubicle.

 

[estellemorris]

OK,I understand, so assuming I can copy a vbs or hta file to their PCs (or asked them to download it from my website) how do I go about setting up the automated FTP system for them to browse and upload file (sorry for my ignorance)

 

[Sheco]

what about email?

 

[theniteowl]

How does the file get named and is it always in the same place?

Here is some code I was working on to do FTP. Save it as a .vbs file. The parameters are hard coded. You would have to modify the code to allow for dynamic values but it all depends on exactly what you need to do.
It would also be easy to make this all a VBScript function in a .HTA page and add in browsing capabilities to get to the file and pass in the filename.

' You may specify a wildcard in filename (e.g. *.txt).
' NB: You need to have C:\winnt\system32\wshom.ocx registered to use the WSCRIPT.SHELL object.
' It is registered by default, but is sometimes removed for security reasons.
' You will also need cmd.exe in the path, which again is there, unless the box is locked down.

Dim oTextFile, oScript, oScriptNet, FSO, oFile, strCMD, strTempFile
Dim ArrgObj, address, username, password, temp_dir, file_dir, filename, remote_dir
Dim myarray, LogStr, line, code, fname, status, specs, tostr

' ### Read in command line values. ###
Set ArgObj = WScript.Arguments 
address = ArgObj(0) 
username = ArgObj(1)
password = ArgObj(2) 
temp_dir = ArgObj(3)
file_dir = ArgObj(4)
filename = ArgObj(5)
If ArgObj.length > 6 Then
  remote_dir = ArgObj(6)
Else
  remote_dir = ""
End If
set ArgObj = Nothing


' Use the below values for hardcoded parameters.
' Edit these variables to match your specifications
address          = "[URL unfurl="true"]www.somewhere.com"[/URL]
username         = "username"
password         = "password"
temp_dir 	      = "C:\" 'Local folder where temporary files are created.
file_dir 	      = "C:\" 'Path of folder containing files to FTP.
remote_dir = "" ' Leave blank if uploading to root directory
filename     = "testing.txt"     ' You can use wildcards here (e.g. *.txt)


'	On Error Resume Next
Set oScript = CreateObject("WSCRIPT.SHELL")
Set FSO = CreateObject("Scripting.FileSystemObject")

' ### Build the ftp commands file ###
Set oTextFile = FSO.CreateTextFile(temp_dir & "temp.ftp")
oTextFile.WriteLine "lcd " & file_dir
oTextFile.WriteLine "open " & address
oTextFile.WriteLine username
oTextFile.WriteLine password
' If destination folder is not the root then issue cd command to change folders.
If remote_dir <> "" Then
   oTextFile.WriteLine "cd " & remote_dir
End If
oTextFile.WriteLine "prompt"
' Set to binary mode.
oTextFile.WriteLine "binary"
' If there are multiple files use the command 'mput', instead of 'put'
If Instr(1, filename, "*",1) Then
  oTextFile.WriteLine "mput " & file_dir & filename
Else
  oTextFile.WriteLine "put " & file_dir & filename
End If
oTextFile.WriteLine "bye"
oTextFile.Close
Set oTextFile = Nothing


' ### Execute the FTP.exe program and capture screen output to temporary file
' Use cmd.exe to run ftp.exe, parsing our newly created command file
strCMD = "ftp.exe -s:" & temp_dir & "temp.ftp"
strTempFile = temp_dir & FSO.GetTempName( )
' Pipe output from cmd.exe to a temporary file
Call oScript.Run ("cmd.exe /c " & strCMD & " > " & strTempFile, 0, True)
Set oScript = Nothing

' ### Grab output from temporary file and parse it for output to log file. ###
Set oFile = FSO.OpenTextFile (strTempFile, 1, False, 0)
'	On Error Resume Next
If remote_dir = "" Then
  tostr = "Root"
Else
  tostr = remote_dir
End If
LogStr = Now() & vbCrLf & "Copying " & filename & " from: " & file_dir & " to: " & tostr & " on " &  address & vbCrLf
While not oFile.AtEndOfStream
  line = oFile.ReadLine()
  code = Left(line, 3)
  Select Case code
    Case "150" ' Output fname and stats for successful or fname and error message.
      ' Get the fname from the end of the string.
      myarray = Split(line)
      fname = myarray(Ubound(myarray))
      status = oFile.ReadLine()
      If Left(status, 3) = "226" Then
        specs = oFile.ReadLine()
        LogStr = LogStr & fname & " - " & Right(specs, Len(specs)-5) & vbCrLf
      Else
        LogStr = LogStr & fname & ": " & "ERROR " & status & vbCrLf
      End If
    Case "421"
      LogStr = LogStr & "ERROR 421: Temporary Error - Service not available, closing control connection." & vbCrLf
    Case "425"
      LogStr = LogStr & "ERROR 425: Temporary Error - Cannot open data connection." & vbCrLf
    Case "426"
      LogStr = LogStr & "ERROR 426: Temporary Error - Connection closed; transfer aborted." & vbCrLf
    Case "450"
      LogStr = LogStr & "ERROR 450: Temporary Error - Requested file action not taken. File unavailable (for example, file busy)." & vbCrLf
    Case "451"
      LogStr = LogStr & "ERROR 451: Temporary Error - Requested action aborted: Local error in processing." & vbCrLf
    Case "452"
      LogStr = LogStr & "ERROR 452: Temporary Error - Requested action not taken. Insufficient storage space in system." & vbCrLf
    Case "500"
      LogStr = LogStr & "ERROR 500: Permanent Error - Syntax error, command unrecognized. This may include errors such as command line too long." & vbCrLf 
    Case "501"
      LogStr = LogStr & "ERROR 501: Permanent Error - Syntax error in parameters or arguments." & vbCrLf
    Case "502"
      LogStr = LogStr & "ERROR 502: Permanent Error - Command not implemented." & vbCrLf
    Case "503"
      LogStr = LogStr & "ERROR 503: Permanent Error - Bad sequence of commands." & vbCrLf
    Case "504"
      LogStr = LogStr & "ERROR 504: Permanent Error - Command not implemented for that parameter." & vbCrLf
    Case "530"
      LogStr = LogStr & "ERROR 530: Permanent Error - Not logged in." & vbCrLf
    Case "532"
      LogStr = LogStr & "ERROR 532: Permanent Error - Need account for storing files." & vbCrLf
    Case "550"
      LogStr = LogStr & "ERROR 550: Permanent Error - Requested action not taken. File unavailable (for example, file not found, no access)." & vbCrLf
    Case "551"
      LogStr = LogStr & "ERROR 551: Permanent Error - Requested action aborted: Page type unknown." & vbCrLf
    Case "552"
      LogStr = LogStr & "ERROR 552: Permanent Error - Requested file action aborted. Exceeded storage allocation (for current directory or dataset)." & vbCrLf
    Case "553"
      LogStr = LogStr & "ERROR 553: Permanent Error - Requested action not taken. File name not allowed." & vbCrLf
  End Select
Wend
LogStr = LogStr & vbCrLf

oFile.Close
' Delete the output response & ftp-command files
Call FSO.DeleteFile( strTempFile, True )
Call FSO.DeleteFile( temp_dir & "temp.ftp", True )
Set FSO = Nothing

' Print result of FTP session to screen
MsgBox LogStr

It's hard to think outside the box when I'm trapped in a cubicle.

 

[estellemorris]

thanks for this - very useful