Groups | Blog | Home
all groups > iis security > december 2005 >

iis security : How to Restrict Unauthorized Downloads


John Blessing
12/2/2005 1:30:57 PM
[quoted text, click to view]


Move the files to a folder above your webroot. If authenticated send the
file via email from the server.

--
John Blessing

http://www.LbeHelpdesk.com - Help Desk software priced to suit all
businesses
http://www.room-booking-software.com - Schedule rooms & equipment bookings
for your meeting/class over the web.
http://www.lbetoolbox.com - Remove Duplicates from MS Outlook
http://www.outlook-find-replace.com - Find & Replace in Emails, Contacts,
Appointments, Tasks and Notes
http://www.schedule-email.com - Schedule multiple individual
emails/newsletters

Prabhat
12/2/2005 3:54:59 PM
Hi All,

I have a website setup which also provide ability to download latest version
of our Software by logging into the webpage. All latest softwares (ONLY ONE
FILE .EXE for each Software) are located in the "/Download" folder of my
website. Customer will login to website and the ASP page decide the software
that this user has purchased and privide ONLY that Hyperlink to download the
latest Version file.

My problem is if somoe body know the path and file name then they directly
put the URL in address bar and will get latest file. How do I restrict that?
Please suggest all possible solutions.

Let me know if my question is not clear.

Thanks in advance
Prabhat

Larry Randolf
12/2/2005 10:26:46 PM
www.aspprotect.com can stream downloads after a user is logged in.. you
might want to check that out

www.codewanker.com and www.aspin.com are also good places to look for
something like that

[quoted text, click to view]

Prabhat
12/3/2005 12:00:00 AM
[quoted text, click to view]
Hi John,

But it is not possible to send those files in email. Because the size is
BIG. So only option will be to allow download but securely. If I will move
to a folder above the root then How do I allow download?

Thanks
Prabhat

Evertjan.
12/3/2005 12:39:00 PM
Prabhat wrote on 03 dec 2005 in microsoft.public.inetserver.asp.general:

[quoted text, click to view]


if session("authorized")<>"yes" then response.end

name="xxxx.pdf"
strFilePath="c:\blah\"&name

Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Open

objStream.Type = 1
objStream.LoadFromFile strFilePath

Response.Buffer = false
Response.ContentType = "application/pdf"
Response.AddHeader "Content-Type", "application/pdf"
'' or whatever your file is
Response.AddHeader "Content-Disposition","inline;filename="&name

Response.BinaryWrite objStream.Read
Response.Flush
objStream.Close
Set objStream = Nothing


--
Evertjan.
The Netherlands.
(Replace all crosses with dots in my emailaddress)
Prabhat
12/4/2005 11:50:40 PM
[quoted text, click to view]

Hi Evertjan,

Thanks for this suggestion. This is the kind I was looking for. I should cll
this from the URL Click. Thanks again.

Thanks
Prabhat

AddThis Social Bookmark Button