Secure Folders 1

[ArmandoB]

Hi,

Here's my scenario: I have a website which is designed to only allow authenticated users to browse. The authentication is done through a simple ASP script to check a database for a valid username and password. If it's good it sets a session variable to allow the user to browse. In this website there is a subfolder containing files which I do not want to be publicly accessible by using direct URL entry (ie;

http://www.mydomain.com/mywebsite/myprivatefiles/myfile.doc).

To do this I was considering 2 methods: 1) Set NTFS permissions to only allow authenticated users to see them and 2) using the filesystemobject to retrieve the files from a non-web accessible directory elsewhere on the server.

The problems I'm having with the first option is that because my webpage authenticates to a MySQL database and sets a session variable, technically the authenticated user is still a 'Web Anonymous User' according to Windows.

With the second method, I am having trouble figuring out how to display an image file (ie; .jpg) on the webpage from an <img src> tag using the filesystemobject method of retrieving the file (physical path to the file).

So I'm hoping someone can answer these questions: a) Is there a way using ASP that I can specify a valid NT username so that the user authenticates properly and has access to the files, or, b) does anyone know how to use the filesystemobject to retrieve an image file and display it on the page?

Just to let you know, one thing I tried was using virtual paths to access the folder 1 level up on the physical directory structure which is not web-accessible but because I have disabled parent paths (due to security concerns), this is not possible. Thanks to anyone who can help!

Armando

 

[Develop123]

Are there only image files or any other document also loaded?

U can use the filesystem object to retrive any files located by giving the physical path.

Get the physical path of the file with the name.
set the content type to the type of file u want to display.
Use binary read method of the ADODB.Stream object.

 

[DreXor]

another option which wouldn't take too much overhauling is to add permission "levels" basically an access level, rate it say 1-10 or even 1-5 use that value in the checking of whether or not to allow browsing

then you could either add in the DB a list of folders and min access level.

recently i put up a post under the name binary stream issues, that might help you out in regards to the image question

 

[ArmandoB]

Hi,

First off, thanks to you both for your suggestions. I successfully managed to get some of it figured out. What I did to protect the images in my image folder from anonymous web browsing to the exact filename is set the folder and it's entire contents' attributes to 'hidden'. Now web users simply get a 404 when they try to browse directly to the file and I can still get them in my script using fso and adodb.stream. fso can't display the images because it doesn't support binary reads (as I found out later) and I've also managed to get the images to display on page with the adodb.stream method. Now the ONLY thing that is wrong and left for me to figure out is why, when I use the adodb.stream method to display the image, nothing else on my page gets processed. There are other things happening that displays information about the file (size, create date, etc.) through fso, but none of this gets printed. not even the html to set the page background color works so all i get is a white page and the image i want. Thanks again!

Armando

 

[DreXor]

you make an imagedisplay.asp page, put the adodb.stream and fso into it, feed it arguments via querystring as the source of an <img> tag example :

this is if you're going to store the locations with an index reference in a datasource somewhere
<img src="/imagedisplay.asp?img=24">

or you can link direct to it:
<img src="/imagedisplay.asp?img=/images/header.jpg">

 

[ArmandoB]

Hi,

That's what I had done originally but it wasn't working.. now when I go back and look at it, I realize that the reason why was because of a typo in my img tag linking to the page that contains the fso. I found out later on my problem was that you can't mix binary and ascii data on the same page, hence the reason why i was getting a picture and nothing else. Everything working great now. Thanks to you two for the help!

Armando