Protecting documents

  • Thread starter Thread starter Shawn
  • Start date Start date
S

Shawn

Hi.
I have a folder that contains a lot of different documents. xls, .doc, .pdf
etc. Different users have access to different documents. The problem is
that if a user knows the name of a document then he can just write the path
into IE and get access to it anyway. Is it possible to prevent this?

Thanks,
Shawn
 
Shawn,

If it's required that people be able to download these (which I'm sure it
is), your best bet is to store them on the file system where they are
inaccessible directly. You can then use Response.BinaryWrite to stream
them down to the browser when legitimate.

Here's a small code sample that demonstrates a PDF file loaded both inline
and outside fo the browser.

Dim fs As New FileStream("c:\directory\books.pdf"),
FileMode.OpenOrCreate, FileAccess.Read)
Dim MyData(fs.Length) As Byte
fs.Read(MyData, 0, fs.Length)
Response.Buffer = True
Response.Clear()
Response.ContentType = "application/pdf"

' Opens it outside browser
Response.AddHeader("content-disposition", "attachment;
filename=books.pdf")

' Opens it inside browser
'Response.AddHeader("content-disposition", "inline;
filename=books.pdf")

Response.BinaryWrite(MyData)
Response.End()


Hope that helps.


Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.

--------------------
 
Shawn,

If you set the column to visible="false" you will still be able to access it
in the code-behind. If you need to access its value from the client, then
you are correct you can't set visible="false".

If the latter is the case (you need to access the value from the client
code) you could try using <div> tags around it and setting it's visibility
with CSS.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche
 
Shawn,

Sorry.

I was attempting to post to the message above yours.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche
 
Didn't quite understand what column visibility had to do with protecting
document folders :-)



Shawn,

Sorry.

I was attempting to post to the message above yours.

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

Free code library at:
www.aboutfortunate.com

"Out of chaos comes order."
Nietzche
 
You can do this 2 ways.

One, Jim's way.

The other is to srode diffrent file types in diffrent folders and then configure
diferent web.config files with the user's on each folder.

Joao Cardoso (MVP dotNET)
=======================================================
[LusoCoders]- http://groups.yahoo.com/group/lusocoders/
[PontoNetPT]- http://www.programando.net/regras.aspx
(e-mail address removed)-s.p-a.m - www.acinet.pt
=======================================================
 
Joao,

That will work as long as the file type you are requesting is mapped to the
aspnet_isapi.dll. It's not recommended to map all of these file types to
ASP.NET.

Jim Cheshire, MCSE, MCSD [MSFT]
Developer Support
ASP.NET
(e-mail address removed)

This post is provided as-is with no warranties and confers no rights.


--------------------
 
Joao,
That will work as long as the file type you are requesting is mapped to the
aspnet_isapi.dll. It's not recommended to map all of these file types to
ASP.NET.
Click to expand...

Hi... ur right...

I just remember something... if he is using windows authentication perhaps is as
easy as changing the security settings for diffrent folders....

But still your way seems that will be the best for this scenario.

Joao Cardoso (MVP dotNET)
=======================================================
[LusoCoders]- http://groups.yahoo.com/group/lusocoders/
[PontoNetPT]- http://www.programando.net/regras.aspx
(e-mail address removed)-s.p-a.m - www.acinet.pt
=======================================================
 
Back
Top