User713056278 posted
Hi,
I save the Picture name only in DataBase and the images are in the ImageFolder.
But when i upload a my Application i saw that if enter the ImageFolder Name in url it open all the images Name & open easily with out Login the user.
I Want to make the ImageFolder Secure in a way that it can't be access
According to your description ,for my experience ,you can use Application_BeginRequest method in global.asax file to check whether the URL of page is typed by user and make a judgment that if the extension value of page's
url is .gif or .jpg (and so on) .,then let user know the image file is not allowed to access to.
In this way ,you can avoid user who is not login trying to type the URL and access the image file.
Here is the sample:
1.Create the table which used to store records in database like this:
PermissionForFile tabel
ID
filepath
filename
UserID
user put there Basic information with one Picture etc...
2.When the user uploads a image file ,insert a record to the table in database.
3.Use a page to show the records,suppose the page named as "filelist.aspx".
4.Here is the code.
Code in Global.asax:
void Application_BeginRequest(object sender, EventArgs e)
{
string path = HttpContext.Current.Request.Path;
string[] path_Elements = path.Split('.');
string ext = path_Elements[path_Elements.Length - 1];
if (ext.ToLower() == "gif" || ext.ToLower() == "jpg")
{
if (!IsUrl())
{
HttpContext.Current.Response.Redirect("~/NoPermission.aspx");
}
}
}
bool IsUrl()//The method is used to check whether the page is opend by typing the url in browser
{
string str1 = System.Web.HttpContext.Current.Request.ServerVariables["HTTP_REFERER"];
string str2 = System.Web.HttpContext.Current.Request.ServerVariables["SERVER_NAME"];
return ((str1 != null) && (str1.IndexOf(str2) == 7));
}
2.Code in NoPermission.aspx:
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
<div>
You have no permission to access the page(file)
<a href="filelist.aspx"> filelist.aspx</a>
</div>
</form>
</body>
</html>
3.Code in filelist.aspx(the page is used to show the list of image files which belong to the current user):
.aspx:
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
<div>
<%--Show the list of files base on the value in database after user login--%>
</div>
</form>
</body>
</html>
.cs:
protected void Page_Load(object sender, EventArgs e)
{
if (!CheckIsLogin())
{
Response.Redirect("Login.aspx");
}
else
{
// Use the UserName as UserID to get the records form PermissionForFile tabel
// Display the records as you want.
}
}
public bool CheckIsLogin()
{
// When user login,please set value to Session["User"].
// for example:Session["User"] = UserName;
if (Session["User"] != null)
{
return true;
}
else
{
return false;
}
}
either user Login or Not. I want that he never access ImageFolder .
I would like to suggest you to modify the code in Application_BeginRequest method as below:
void Application_BeginRequest(object sender, EventArgs e)
{
string path = HttpContext.Current.Request.Path;
// Change the name of folder as your own
string foldername = "ImageFolder";
if (path.Contains(foldername))
{
HttpContext.Current.Response.Redirect("~/NoPermission.aspx");
}
}
Please check the links below for the similar threads which provide some solutions for the same issue:
http://forums.asp.net/p/1611551/4124520.aspx
http://forums.asp.net/p/1610459/4125252.aspx#4125252
http://forums.asp.net/p/1622251/4168410.aspx
Hope it can help you.
