a better way?
http://support.microsoft.com/default.aspx?scid=KB%3BEN-US%3BQ276488
Cheers
-----Original Message-----
From: Ian [mailto:webappsec2@fishnet.co.uk]
Sent: Martes, 28 de Septiembre de 2004 04:05 a.m.
To: John M. L.; webappsec@securityfocus.com
Subject: Re: Securing file access
On 27 Sep 2004 at 11:57, John M. L. wrote:
I have a project that involves a members only area on web page on IIS.
The members' only area is secured by a database (MS Access) so users are
authenticated by their name and some MD5 hash etc. I need to allow files
(mostly PDFs) for download to authenticated users only. In my opinion this
means that the files can not be stored in any www accessible folder
(regardless of any renaming convention etc, I absolutely cannot have someone
guess a file name to download). In order to access the files, the database
would link a file to a unique id, so a page that validates the user would
then give access to the file stored outside of the www on the server. Now,
this is where the real question lies. How is this possible since the files
are not in a www accessible path, since a mere link to a file won't due.
Any thoughts would be welcome. If I'm going about this completely wrong
that would be nice to no too :) Forgive me if the answer is simple, I'm a
Linux fan and haven't used IIS etc for years.
One more note: IIS, MS Access and VBScript are not my technologies of
choice, but merely what I was given to work with. I also have very limited
control over administering IIS.
John
www.recaffeinated.com
Hi John,
You are going about this the right way.
Store the PDFs outside the www root, but still give the user ISR_<computer
name>
permission to read the files ( or whatever user your site is running under).
Once the
web user has authenticated, your script can read the PDF into memory then
stream
the file to the user. A simple example is below:
<%
set fs=server.createobject("Scripting.filesystem")
set PDFin=fs.opentextfile(pathtoPDF,1,false)
PDF=PDFin.readall
PDFin.close
set PDFin=nothing
Response.contenttype="application/pdf"
resonse.binarywrite StrToBin(PDF)
response.end
function StrToBin(str)
for x=1 to Len(str)
StrToBin=StrToBin & ChrB(Asc(Mid(str,x,1)))
next
end function
%>
You may not need to use the StrToBin function - I can't remember off the top of
my
head ;)
Regards
Ian
--
