Home Support Site Search Faq Register Login  
FileUp
Inherited Security

Thread Starter: scalbert   Started: 09-05-2014 1:13 PM   Replies: 3
  05 Sep 2014, 1:13 PM
scalbert is not online. Last active: 12/19/2014 4:26:17 PM scalbert

Top 10 Posts
Joined on 04-28-2011
Posts 3
Inherited Security
I have been using FileUp for years for our internet site. The following code always worked fine for a single file upload using <INPUT TYPE="FILE" NAME="myFile">.


Set oFileUp = Server.CreateObject("SoftArtisans.FileUp")
oFileUp.Path = Server.MapPath(Application("vroot") & "/attachments")
If Not oFileUp.Form("myFile").IsEmpty Then
strFileName = Replace(oFileUp.Form("myFile").ShortFileName, " ", "")
strFilePath = "C:\attachments\temp\" & strFileName
oFileUp.Form("myFile").SaveAs strFilePath
End If


However, in preparation of moving to multi-file uploads using XFile, I changed the code to the following:


Set oFileUp = Server.CreateObject("SoftArtisans.FileUp")
oFileUp.Path = Server.MapPath(Application("vroot") & "/attachments")
For Each strFormElement In oFileUp.Form
If IsObject(oFileUp.Form(strFormElement)) Then
If Not oFileUp.Form(strFormElement).IsEmpty Then
strFileName = Replace(oFileUp.Form("myFile").ShortFileName, " ", "")
strFilePath = "C:\attachments\temp\" & strFileName
oFileUp.Form(strFormElement).SaveAs strFilePath
End If
End If
Next


In the former example, the saved file inherited the parent folders security. However, in the newer code, the file is saved with non-inherited security. Only the individual uploading can access the file or an administrator. In fact, when I look at the security tab of the files properties it states "You must have Read permissions to view the properties of this object. Click advanced to continue."

The primary difference, as I can tell is that in the former I reference the Form Post Item by name. And the second uses the Object.

oFileUp.Form("myFile").SaveAs strFilePath

Versus

oFileUp.Form(strFormElement).SaveAs strFilePath

Any help or direction is greatly appreciated.

  
  23 Sep 2014, 11:22 AM
StephanieR is not online. Last active: 9/23/2014 11:25:33 AM StephanieR

Top 10 Posts
Joined on 11-25-2013
Posts 14
Re: Inherited Security
Hello.

The uploaded file does not inherit from the parent directory. Instead, it inherits from the directory where FileUp caches each file. See this KB article for more details: http://support.softartisans.com/kbview_776.aspx

Please let me know if this points you in the right direction.
  
  19 Dec 2014, 3:16 PM
scalbert is not online. Last active: 12/19/2014 4:26:17 PM scalbert

Top 10 Posts
Joined on 04-28-2011
Posts 3
Re: Inherited Security
Unfortunately no, I still have issues. But thank you for the response.

To reiterate, the following seems to be where the issues occur.

oFileUp.Form("myFile").SaveAs strFilePath

Versus

oFileUp.Form(strFormElement).SaveAs strFilePath

If I use the first method, all is fine. If I use the second, security is essentially lost and is no inherited.
  
  19 Dec 2014, 4:26 PM
scalbert is not online. Last active: 12/19/2014 4:26:17 PM scalbert

Top 10 Posts
Joined on 04-28-2011
Posts 3
Re: Inherited Security
Found the issue. The upl.Path = statement did not immediately follow the CreateObject line. There were other lines in there such as the For..Each line.
  
 Page 1 of 1 (4 items)
SoftArtisans Forums » SoftArtisans Products » FileUp » Inherited Security