Uploading to a folder outside the www ... ?

microsoft.public.dotnet.framework.aspnet.webcontrols

15 Jun 2006 8:19 AM

Wayne Smith

Applies to ASP.NET 1.1

I'm in the process of building a small web site for a club I belong to, one
feature of the site which I would like to include is the ability to allow
users to upload images for others on the site to view.

I found some ASP.NET code on a developers web site which seems to do exactly
what I was looking for, I followed the instructions and uploaded the code to
the correct directory and tried to upload a test image to check all was
working, but it came back with an error - fortunately another user had
experienced the same problem and the post on the message board indicated
that permissions would need to be set on the folder where the images were to
be uploaded, I spoke to my domain host and they indicated the entry level
package I'm on does not allow me to change permissions on folders within my
web site, I would have to upgrade my account to a business hosting package
in order to achieve this.

The problem is we are a small club and cost is an important factor, so
upgrading our hosting package is something we cannot afford to do.

After delving a little deeper, the hosting company did indicate that the
database folder is the only folder which allows Read/Write & Execute where
all the other folders only allow Read & Execute permissions.

The problem I have is the database folder is not within the www directory,
when I FTP to the site the two folders I immediately see are:

databases
www

to upload web pages to the site I have to open the www folder and include
them there.

The problem I have is not knowing how to point to this database folder
within the ASP.NET code, because its not part of the www site and is not
accessible from the internet, I'm a bit confused as to how to send images to
that folder - my domain host has indicated that I would need to "include"
the images in a script - but I have no idea how to go about this or what he
means, I'm not a natural programmer so a lot of this just goes straight over
my head unless its explained in an idiots guide manner ...

Can anyone offer a solution or workaround to what I'm trying to do, maybe
even a step-by-step guide on a web site would be a good place to start.

I greatly appreciate any help, suggestions or pointers that you may have.

Many thanks in advance
Wayne

15 Jun 2006 10:54 AM

Jesse Houwing

Wayne Smith wrote:
Show quoteHide quote

> Applies to ASP.NET 1.1
>
> I'm in the process of building a small web site for a club I belong to, one
> feature of the site which I would like to include is the ability to allow
> users to upload images for others on the site to view.
>
> I found some ASP.NET code on a developers web site which seems to do exactly
> what I was looking for, I followed the instructions and uploaded the code to
> the correct directory and tried to upload a test image to check all was
> working, but it came back with an error - fortunately another user had
> experienced the same problem and the post on the message board indicated
> that permissions would need to be set on the folder where the images were to
> be uploaded, I spoke to my domain host and they indicated the entry level
> package I'm on does not allow me to change permissions on folders within my
> web site, I would have to upgrade my account to a business hosting package
> in order to achieve this.
>
> The problem is we are a small club and cost is an important factor, so
> upgrading our hosting package is something we cannot afford to do.
>
> After delving a little deeper, the hosting company did indicate that the
> database folder is the only folder which allows Read/Write & Execute where
> all the other folders only allow Read & Execute permissions.
>
> The problem I have is the database folder is not within the www directory,
> when I FTP to the site the two folders I immediately see are:
>
> databases
> www
>
> to upload web pages to the site I have to open the www folder and include
> them there.
>
> The problem I have is not knowing how to point to this database folder
> within the ASP.NET code, because its not part of the www site and is not
> accessible from the internet, I'm a bit confused as to how to send images to
> that folder - my domain host has indicated that I would need to "include"
> the images in a script - but I have no idea how to go about this or what he
> means, I'm not a natural programmer so a lot of this just goes straight over
> my head unless its explained in an idiots guide manner ...
>
> Can anyone offer a solution or workaround to what I'm trying to do, maybe
> even a step-by-step guide on a web site would be a good place to start.
>
> I greatly appreciate any help, suggestions or pointers that you may have.
>
> Many thanks in advance
> Wayne

You have a couple of options here. First let's start with the fact that
you can't directly reference any files not in the webroot period.

But there are a few ways to circumvent that. They all come down to the
same basic technique. Set up some kind of proxy system that will look at
the parameters it received and then send the correct file from the
database folder programatically to the client. For this proxy you have
two options:
- Set up an aspx file which gets the name of the file to transfer in an
querystring parameter
- Set up a HttpModule which knows based on the url that the files have
to be transferred from outside the webroot.

For now the easiest way is probably the first one.

Create a new aspx, in the page_load place the following code:

string filename = Request.QueryString["filename"];
// check if filename contains any illegal characters,
// doesn't start with a / or .. and does not contain /../.

Response.ContentType = "contenttype of the file";
FileStream file = new
FileStream(filename,FileMode.Open,FileAccess.Read);
ASCIIEncoding a = new ASCIIEncoding();
BinaryReader b = new BinaryReader(file,a);
Byte[] bytes = b.ReadBytes((int)file.Length);
Response.BinaryWrite(bytes);
Response.End();

That should do the trick.

A better way would be to use HttpModules, but they're a lot trickier.

Jesse Houwing