Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Virtual Directory File Access. Access Denied

$
0
0

My development machine:  MS Windows 7 Prof. IIS 75. Visual Studio 2008 Prof.

My CURRENT (after many variations) setup: Within IIS, I have an application, MyDSS that has a virtual directory, AppFiles, pointing to a physical location outside of the application. My hope was to allow users to manage their files within this virtual directory, meaning they can Add, delete, rename and preview them. I granted the group <localmachine>\IIS_IUSRS permissions to the physical directory. I made the user ASPNET a member of the IIS_IUSRS group. Within IIS, under the applications IIS Authentication, I have the Anonymous Authentication set to Disabled and the ASP.NET Impersonation set to enabled, with the user specified as the ASPNET user that has permissions to the physical file directory. 

I am able to Save a file with the following VB code:

Dim filename = Path.GetFileName(fileuploadimages.PostedFile.FileName) ' Get the filename
fileuploadimages.SaveAs("C:\inetpub\wwwroot\ApplicationUploads\MyDSSFiles\VisitationFiles\" + filename) ' save to webserver

I am able to Delete a file with the following VB code:

Dim filename = CType(grdAttachments.Rows(e.RowIndex).FindControl("lblDocumentName"), Label).Text ' Get the filename
File.Delete("C:\inetpub\wwwroot\ApplicationUploads\MyDSSFiles\VisitationFiles\" + filename

Write/modify permission are alive and well, correct?! - I would venture yes because I'm able to delete and save files. With those types of permissions, you'd think that previewing the file is a piece of cake, correct?! - NOPE

I am UNABLE to preview the file with the following code:

function OpenReportsWindow(URL) {
	var objClientWindow = window.open(URL,
	null,
	'width=850,height=600,status=no,scrollbars=yes,resizable=yes,top=100,left=100,dependent=yes,alwaysRaised=yes'
	);
	objClientWindow.opener = window;
	objClientWindow.focus();
	return;
}

where URL has been tested directly to the physical path, using C:\inetpub\wwwroot\ApplicationUploads\MyDSSFiles\VisitationFiles\wtf.pdf
AND tested with the Virtual Directory, ../AppFiles/MyDSSFiles/VisitationFiles/wtf.pdf AND some other attempts.

If I place the file in a subdirectory under the applications root directory and reference it with the same code above plugging in the URL, C:\inetpub\wwwroot\MyDSS\Visitations\Attachments\wtf.pdf, it does not work. However; if I plug in the URL, ..\Visitations\Attachments\wtf.pdf, it works perfectly fine.

It could/could not be a permissions problem although, I feel like I have covered all those bases by giving AD permissions the the physical path where the file is and setting the ASPNET user as the impersonated user in IIS for the application with a virtual directory pointing to the physical path.

 I am beyond frustrated with this at this point, so any help would be greatly appreciated!

NOTE: I forgot to mention in the initial post that the error I'm getting, when it attempt to open the file is "Microsoft JScript runtime error: Access is denied"


Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>