Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 202
  • Last Modified:

Virual Directory to Retrieve files in another Hard Disk of a computer

Good Day Experts,

I would just like to know if it is safe to point a link of a virtual directory in IIS.

Say I have a website running in ASP.NET codebehind VB.NET and say that this is the link

https:\\www.domain.com\virtualdirectory\index.aspx

- The virtualdirectory is one of the websites created in IIS.
- INside the index.aspx is a DataGrid that holds information and one of these information is a link of a audio file that they an download.
- The file that they are trying to download isn't in IIS its on another HARD Disk but on the same computer say D:Drive.
- I created a new Virtual Directory which points to this Drive(D).
- THe link I was talking about contains a link pointing to this Vitrual Directory.
- Same Link would be "http:\\www.domain.com\VitualDriveD\filename
- So as you can see the URL is exposed and even though I have a login page where they can authenticate themselves if they know the URL they can just go and download it directly... IF THEY KNOW THE URL.

MY QUESTION IS... IS THERE A BETTER WAY OR DO i just need to change something in what I am doing.


Thanks In Advance GUYS and GALS...

vncmrc12
0
vncmrc12
Asked:
vncmrc12
  • 4
  • 4
1 Solution
 
kochergaCommented:
Please explain what is your problem. What are you trying to do? You want the users to be able to download a file by clicking a link. But you do not want them to do the same without clicking the link, right? Does that describe your problem?
0
 
vncmrc12Author Commented:
kocherga,

Well something like that. I have been seing in some website that uses ASP.NET when you click a hyperlink it shows a http:\\www.domain.com\?>.......

THis is a link but it actually a link that has been redirected so when you try to just cut and paste them into a new IE windows it  wo=nt get through or execute.

My question is that how can I do that... Thank.. hope this helps......

vince12
0
 
kochergaCommented:
Your link can point to an asp page in the same virtual directory.

The page would check referral header and if necessary cookies.
If everything is ok, it will execute these 2 lines:

Response.ContentType = "audio/wav" 'or whatever the type is
Server.Transfer(your file path)

The file can be in a directory under the same virtual directory and that directory may be configured inaccessible from outside.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
vncmrc12Author Commented:
kocherga,

-Currently for example I have my website's url at www.vncmrc12.com\datagridexample.aspx.

- Inside this datagrid contains a link inside my website.

- THis link is directed to a virtual directory which you showed me how to do.

- You said that the page would check referral header from another page?

- Can you show me code.... anything would be much appreciated... thank you...

- I also have a ASP.NET book with me, what topic is this in ASP.NET. Is it the State Management topic... thanks again
 
0
 
kochergaCommented:
No, referrer header has nothing to do with state management.
Check Request object, ServerVariables property.

You have to check this expression:

Request.ServerVariables("HTTP_REFERER")
(Yes, it is misspelled).

You check whether it is the URL of your page with the link.
If it is blank then the URL was entered directly.
0
 
vncmrc12Author Commented:
kocherga,

Thanks for that tip.

-Okay so far this is what I have been doing. I have 2 webpages namely page1.aspx and page2.aspx.
-page1.aspx has a link going to pag2.aspx.
-2 I have created a hidden label and place the code lblVariable.Text = Request.ServerVariables("HTTP_REFERER").
- It shows on the label the previous website I came from.
- but when I try to click the link to download an audio in page2 it still shows the complete url of the link. So even though the user don't go into my website and just remembers the URL he/she can download this audio file. Any ideas...
- I am currently experementing on the ?filename=&foldername=, I believe these are the Request.QueryStrings.... do you have any ides on how can I do this...

vncmrc12

PS. Thank again.
0
 
kochergaCommented:
1. You do not need a label.
2. "It shows the URL" is not the same as "the user can download the file".

You have to put something like this:
if Request.ServerVariables("HTTP_REFERER")="http://vncmrc12.com/page1.aspx"
Response.ContentType = "audio/wav" 'or whatever the type is
Server.Transfer(your file path)
end if

If you go to page2 by clicking the link the condition in IF will be true. If not (the URL entered into the location bar) the condition will be false and the file will not be downloaded.
0
 
vncmrc12Author Commented:
kocherga,

Got it.... saved me alot of sleepless night....

vncmrc12
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now