Welcome to WebmasterWorld Guest from 18.206.168.65

Forum Moderators: ocean10000

Message Too Old, No Replies

Creating a text file using ASP

     
3:57 am on Aug 27, 2009 (gmt 0)

Preferred Member

10+ Year Member

joined:May 23, 2002
posts:446
votes: 0


Hi

I can create a text file using ASP but I'm concerned about the security implications.

If I open up access in the folder properties to allow all users to be able to write to the folder am I creating the situation whereby a 'bad guy' can do my server some harm?

Thanks

Mick

4:56 am on Aug 27, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 1, 2005
posts:732
votes: 0


Hi Mick,

You do not have to give everyone write permissions if ASP is creating the files, the IUSR_<computerName> user should be sufficient for classic ASP. (for ASP.Net you need the NETWORK_SERVICE account)

5:12 am on Aug 27, 2009 (gmt 0)

Preferred Member

10+ Year Member

joined:May 23, 2002
posts:446
votes: 0


That's great Marcel. I've never heard of that (using classic AS)...off to Google it.

<shameless>
any sample code that would point me in the right direction?
</shameless>

5:34 am on Aug 27, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 1, 2005
posts:732
votes: 0


Are you using ASP or ASP.Net? (and if ASP.Net, VB or C#)

- Classic ASP [w3schools.com]
- ASP.Net [4guysfromrolla.com]

[edited by: marcel at 5:38 am (utc) on Aug. 27, 2009]

5:37 am on Aug 27, 2009 (gmt 0)

Preferred Member

10+ Year Member

joined:May 23, 2002
posts:446
votes: 0


Classic ASP and VB Script, cheers.
5:38 am on Aug 27, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 1, 2005
posts:732
votes: 0


Sorry, just edited my previous post with some links
5:48 am on Aug 27, 2009 (gmt 0)

Preferred Member

10+ Year Member

joined:May 23, 2002
posts:446
votes: 0


Thanks Marcel. I can actually create the text file using the FileSystemObject but I thought from your earlier post that I could identify myself to the server as a user that has write privileges. (can that be done?)

Thanks

Mick

7:03 am on Aug 27, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 1, 2005
posts:732
votes: 0


Ah, I misunderstood.

No, you do not need to do this with a script. In the folder properties, go to the security tab and give the user whose name begins with 'IUSR_' (and then the computer name) write privileges.

This is the account that ASP runs under.

Or, you will need to set it up so that you need to login to save a text file. You can do this in IIS (Allow anonymous access to false)

7:33 am on Aug 27, 2009 (gmt 0)

Preferred Member

10+ Year Member

joined:May 23, 2002
posts:446
votes: 0


Fantastic. Thanks very much Marcel. I've been struggling with this for a long time.

Just a free translation, but:

Dank u heel veel Marcel. U bent een geweldige hulp geweest.

8:00 am on Aug 27, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Feb 1, 2005
posts:732
votes: 0


Dank u heel veel Marcel. U bent een geweldige hulp geweest.

:) Thanks, glad to have been of help.