1

Our ASP.NET C# web application uploads various files like jpgs, pngs, docx, txt, etc to a folder called ClientBin. Everything works fine on our Visual Studio 2010 .NET test server that comes along with the Visual Studio 2010 .NET IDE.

However, if we deploy the application to an IIS7 server, we have to give the web user of our application permission to upload file. We basically log on to our Server with IIS7, and then manually modify Security properties of the folder called ClientBin that should ultimately contain the content like jpgs, pngs, docx, txt, etc.

---Manual approach to allow web user to upload successfully work---------------------------

Right-click the projectfolder\ClientBin folder in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access. ---Manual approach to make uploading successfully work---------------------------

--Programmatic approach which still gives web user an Exception error when trying to upload------------------

String DirectoryPath = System.IO.Path.Combine(Server.MapPath("~/ClientBin/"));
DirectorySecurity specificDirectorySecurity = Directory.GetAccessControl(DirectoryPath);
specificDirectorySecurity.AddAccessRule(new FileSystemAccessRule("Users", FileSystemRights.Modify, AccessControlType.Allow));
specificDirectorySecurity.AddAccessRule(new FileSystemAccessRule("Administrators", FileSystemRights.Modify, AccessControlType.Allow));
specificDirectorySecurity.AddAccessRule(new FileSystemAccessRule("SYSTEM", FileSystemRights.Modify, AccessControlType.Allow));
Directory.SetAccessControl(DirectoryPath, specificDirectorySecurity);

--Programmatic approach which still gives web user an Exception error when trying to upload------------------

Another online post suggested I solve the issue by entering the following in web.config:

----XML configuration that might solve problem with programmatic approach--------

identity impersonate="true" userName="ComputerName\Administrator" password="don"

----XML configuration that might solve problem with programmatic approach--------

However, I'm worried about security issue if I make identity impersonate to true.

What is the most secure and most automated ( which might mean a programmatic solution) way of doing this?

Thanks,

newemployee

2
  • Never, EVER, allow your users to upload stuff into your application folder. First uploaded and run script will blow up your application. Aug 14, 2012 at 18:14
  • @WiktorZychla I agree. You only need a flaw to be discovered in ASP.NET, IIS or Windows and you could be compromised. Better to upload binary to an external data source. Aug 16, 2012 at 8:05

2 Answers 2

1

Typically the application is given rights to the directory and the application manages the users access to the upload folder.

4
  • However, is it good practice to enter the following into the application web.config file: identity impersonate="true" userName="ComputerName\Administrator" password="don" ?
    – crazyTech
    Aug 14, 2012 at 18:18
  • 1
    @user1338998 no, first an application should never have administrative rights and second the application already runs under a system account. You can either give the system account(you can find it in the application pool) permissions or create an account for the application to use that can be set in the application pool. Aug 14, 2012 at 18:30
  • The NETWORK SERVICE account is associated with the application pool that has the web application that I am developing. I could manually add that to the "Group or UserNames" associated with the Permissions for ClientBin. However, may I please know if it's possible to do this programmatically(or in some kind of automated way)? If so, how would I go about doing this?
    – crazyTech
    Aug 14, 2012 at 20:53
  • 1
    @user1338998 I am sure it can be done, but I've never done it before. A quick google search will give you an answer. Aug 14, 2012 at 21:01
0

All:

Even though I failed to figure out how C# can modify permissions for upload folder.

It seems that Microsoft Windows PowerShell can programmatically modifies permissions for upload folder.

Here is a snippet of the code that programmatically modifies permissions for upload folder:

$computerHostName = [System.Net.Dns]::GetHostName()

#These constants are used to set permissions
$inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"

$propagation = [system.security.accesscontrol.PropagationFlags]::None

$colRights = [System.Security.AccessControl.FileSystemRights]"Modify"

$objType =[System.Security.AccessControl.AccessControlType]::Allow

#(MSDN Docs) The IIS_IUSRS Group has access to all the necessary file and system     resources
# so that an account, when added to this group, can seamlessly act as an application     pool identity.
#  IIS_IUSRS group by default includes the web users that log on to the Perls    Applications. 
#If a web user needs to upload resources to the folder within the Perls Web     Application that
# contains uploaded resource files then we need to ensure that the members of the
# IIS_IUSRS Group have permissions to add resource files to that particular Perls Web      Application upload folder.

#This determines which user is the guest user for IIS.  Windows Vista and 08 use the      IIS_USRS group, Previous version use
#IUSR_[MachineName]



  if ([environment]::osversion.Version.Major -eq 6) {
  $webUser="IIS_IUSRS"


  } else {

     $webUser="IUSR_" + $computerHostName

 }


$clientBinDirectoryPath = "D:\DeployedApplications\" + $umbrellaComponentName + "\" +     $siteWebComponentName + "\" + "ClientBin"

$perlsPivotErrorDirectoryPath = "D:\DeployedApplications\" + $umbrellaComponentName +      "\" + $siteWebComponentName + "\" + "PerlsPivotErrorDirectory"

$aclForClientBinDirectoryPath = Get-Acl $clientBinDirectoryPath


$accessRuleForClientBinDirectoryPath = New-Object     System.Security.AccessControl.FileSystemAccessRule($webUser, $colRights, $inherit,     $propagation, $objType)

$aclForClientBinDirectoryPath.AddAccessRule($accessRuleForClientBinDirectoryPath)

Set-Acl -aclobject $aclForClientBinDirectoryPath $clientBinDirectoryPath

$aclForPerlsPivotErrorDirectoryPath = Get-Acl $perlsPivotErrorDirectoryPath

$accessRuleForPerlsPivotErrorDirectoryPath  = New-Object     System.Security.AccessControl.FileSystemAccessRule($webUser, $colRights, $inherit,     $propagation, $objType)

$aclForPerlsPivotErrorDirectoryPath.AddAccessRule($accessRuleForPerlsPivotErrorDirectoryPath)

Set-Acl -aclobject $aclForPerlsPivotErrorDirectoryPath $perlsPivotErrorDirectoryPath
1
  • 1
    @chuck-conway Figured out how to use Microsoft Windows PowerShell to programmatically modify permissions for upload folder.
    – crazyTech
    Feb 26, 2013 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.