Creating a text file using ASP

[giggle]

Hi

I can create a text file using ASP but I'm concerned about the security implications.

If I open up access in the folder properties to allow all users to be able to write to the folder am I creating the situation whereby a 'bad guy' can do my server some harm?

Thanks

Mick

[marcel]

Hi Mick,

You do not have to give everyone write permissions if ASP is creating the files, the IUSR_<computerName> user should be sufficient for classic ASP. (for ASP.Net you need the NETWORK_SERVICE account)

[giggle]

That's great Marcel. I've never heard of that (using classic AS)...off to Google it.

<shameless>
any sample code that would point me in the right direction?
</shameless>

[marcel]

Are you using ASP or ASP.Net? (and if ASP.Net, VB or C#)

- Classic ASP [w3schools.com]
- ASP.Net [4guysfromrolla.com]

[edited by: marcel at 5:38 am (utc) on Aug. 27, 2009]

[giggle]

Classic ASP and VB Script, cheers.

[marcel]

Sorry, just edited my previous post with some links

[giggle]

Thanks Marcel. I can actually create the text file using the FileSystemObject but I thought from your earlier post that I could identify myself to the server as a user that has write privileges. (can that be done?)

Thanks

Mick

[marcel]

Ah, I misunderstood.

No, you do not need to do this with a script. In the folder properties, go to the security tab and give the user whose name begins with 'IUSR_' (and then the computer name) write privileges.

This is the account that ASP runs under.

Or, you will need to set it up so that you need to login to save a text file. You can do this in IIS (Allow anonymous access to false)

[giggle]

Fantastic. Thanks very much Marcel. I've been struggling with this for a long time.

Just a free translation, but:

Dank u heel veel Marcel. U bent een geweldige hulp geweest.

[marcel]

Dank u heel veel Marcel. U bent een geweldige hulp geweest.

:) Thanks, glad to have been of help.