Blog Entry: 3/25/2006 4:29:55 PM
Using just ASP (Form Based Authentication) you can only protect the actual content of the ".asp" files.
You can however use some ASP tricks to stream other types of files to the users.
That way the actual file locations are never known and they can only get them/see these files when they are logged in as you would be streaming files to them after they logged in.
Below are informative links I have collected on the subject in an email I sent to another customer a while back.
Using Active Server Pages you can only protect ".asp" pages.
You can however password protect ".asp" pages that stream files to the user using code like in these examples therefore keeping the actual file name a secret.
And from another email I sent...
ASPProtect only protects the content of ".asp" pages. Directory protection is not possible using just ASP.
Other file extensions can not be protected using just ASP.
There are ways to get around this.
You'd want to do a technique like this to stream non ".asp" files to the users.
The safileup component from softartisans can actually do something similar as far as streaming the files go.
Then use something like ASPProtect to protect the ASP files that streams the files.
The actual location of the files is never known to the users and of they don't have access to the asp pages they can not see or get those other types of files.
Very doable, but nothing ASPProtect takes care of automatically.
This info above should get ya on track.
cwilliams38344.8751736111, like I said you made changes to something to cause that...
users/user_area.asp
runs fine the way it ships "it is one of things I tested earlier when I looked at your installation for you"
If you want I'll go look via FTP and tell you what is wrong
cwilliams38456.1069212963,
Two things you can do to test..
make sure there is at least one ".log" file in that directory.. then if you go to the log file screen and it does not show up in the list the physical path you are using is just not correct
remember the physcial path must contain a drive letter (sometimes a network path starting with // is ok if they have it setup as a network drive)
the other thing you can do is use this script to try and write a simple text file in the directory
http://www.devasp.com/samples/writetofile.asp
That will show you if permissions are correct
, ASPProtect v7 comes with working example code of protecting a file download.
This comes with the system as an example folder with some files in it.
(some of the initial purchaser's of the system might not have that directory.. if that is the case please ask)
Here is how it works...
Basically we protect the file download by only allowing a logged in user to download it. The special ".asp" page we use the stream the file is password protected. It also hides the true location of the file so you can keep your files out of your web or keep them in a folder in your web that does not allow file browsing. Under this scenario even if someone looks at the html source they can not tell where the file really came from and they can only download if they are logged in and you offered them the link to the file.
For the file download protection examples to work you may need to edit some values
in the stream_download.asp file that are valid for your setup.
Look at the source. The values you can edit are commented.
Now, you also need to call a valid "download file name" from the download_link.asp file which is an example of how make a download link to the streamed download.
Lastly, we provide a working example. Now, you obviously may need to customize it to fit your needs. Please realize you are going to have to make special download links in your .asp pages and not only should you only show those links to people with appropriate access to download the files, but you should also protect the streaming download page accordingly as well as far as level, groups, and particular users. What I am saying is which files a particular user is allowed to download is not automatically handled by ASPProtect in any way. We give you all the tools to provide protected downloads to logged in users, but if you have complex needs you’re probably going to need to come up with a system that works for you. It's not really difficult because we did all the complicated stuff, but its something you have to sort out.
Perhaps someday in the future ASPProtect will have an interface to upload files and associate them with certain users. But at the moment it does not.
, Humm, Did you make any changes to the code ?
Solid Black is not the default so it must have changed at least once.
Otherwise it might be some sort of application variable problem.
I would make sure the web is and "application" in the IIS console.
, sure (XP PRO), see my article on that
http://www.powerasp.com/content/new/windows_xp_pro_and_permi ssions.asp
, UPDATE
Version 8.1 has code generators for these new methods built in...
, We do not support customization of the code or any custom coding you may end up doing with Visual Studio.NET. However, if you can show me that the application functions incorrectly in its default unmodified form I can help. If not it has to be something you did most likely.
Though I do not if it is the issue, mixing c# and vb.net in the same project can be tricky if not problematic. It’s definitely just not something I can support.
If you have not seen it we have tuturial on setting up the project in visual studio.net.
http://support.cjwsoft.com/code/moreinfo85-1.htm
I would suggest starting with a clean installation. Test everything to make sure the things you say are ok or not. (if not post here about it) Then try your hand at editing the application and compiling it. Keep the c# out of the mix at 1st.
I am not even sure if adding c# to the same project is feasable.
(maybe it is , maybe it isn't)
That being said.. ASPProtect.NET can of course be used to protect pages using c#. But compiling the ASPProtect.NET project with C# code added sounds a bit iffy to me. We wrote the application in VB.NET so you really need to use vb.net when making changes to it.
, When I add a user, I can not activat it.
It sends me back to log on and will now allow me to log in as admin???
I can restart the APP and log in as Admin, but the user I added
is still not activated??
My system will also not allow me to set the Stay Loged in FLag.
It just ignores it....
, If you bought ASPBanner Unlimited Version 7.3 Before August/10/2004 this file needs to be updated.
It fixes a bug where the JavaScript method is not properlly closing an html Image tag. It can cause other hyperlinks on your web page to link to the same place the banner links to. This does not always happen but this fix is the way the code should be so it is best to update it.
Copy this file into your ASPBanner folder over the existing file of the same name.
2004-08-10_125304_injectbanner.zip
cwilliams38209.5378009259, lets get back to using the forum and not the pm's please only use the PM's for sensative information. its too hard for me to keep track of all of this as well as help everything else when I got an inbox full of pm's
Ok, so you say no paypal subscription info is being put in the database at all.
I know we have a bunch of people using the paypal subscription code with no issues so I know it works but obviously you got something wrong.
It could be a few things.
Did you enable IPN in the paypal system and put in a postback url like my directions say ?
Are you sure you are not getting paypal single payments and paypal subscriptions mixed up ?
Are the paypal links you made for paypal subscriptions in the correct format like are directions state ? That is critical and another example of something important that you have not shown me.
Did you populate all settings correctly for our paypal subscription code ?
This includes a correct and valid postback url because if that is not right paypal cant communicate with the aspprotect system and no info will get posted back from them at all.
You say your upgrade went well but if you did all all field names perfectly there could be issues with that.
There is just way too much for me to figure out under free support with the info you keep providing me.
I dont think we are going to get anywhere unless I go into your system and spend a considerable amount of time checking everything out. That is not something I do under normal support so if you are interested it is going to involve a fee paid via paypal. It's probably going to take me a while to check everything out and I need you to be 100% sure IPM is enabled in your PayPal account. If you are not sure how to turn it on search their help system as they have plenty of documentation on the process.
, I purchased 6.0 in Feb 05. Is there an upgrade price to 7.0
I spent considerable time setting up 6.0 to work with my web site. From what I read in the forum, it sounds like I have to start over again to integrate the new version into our web site. I do not relish the thought of that, but I have to move to an email system with a valid MX record.
Will I be starting over from scratch with this upgrade?
, all that docmunetation is online as well right here so you dont really need the chm file
http://support.cjwsoft.com/code/info24.htm
the chm format is a windows format that can only be viewed on windows pcs. I do not know why you can not see it. I would do reseach on viewing CHM files on whatever operating system and version you are running because perhaps you are using a mac or linux operating system which can not natively view chm files ?
, What other information do you have ?
Details are very important.
Info on situations where it works... like OS, browser version.. etc etc
Info on situations where it does not work... same stuff
size of the PDF files ?
server info ?
Maybe protect a page and offer a PDF file so myself and some of the forum users can try it and report back what happens.
Also, Many people zip up PDF files when letting people download them as browsers can act pretty odd at times with them. Perhaps that is an option.
, at some point I can do the users in mass correct using the import feature in aspprotect right?, thats because you can not have exchange server running at the same time as the windows IIS virtual smtp server..
they clash with one another... and thats why the emails never get picked up by the iis stmp server
you have to send the emails another way like using a true remote mail server.. I am not sure but if your exchange server can do pop 3 you can probably use that that way
you may be able to change the pickup directory that cdosys uses under the virtual SMTP scenario, but I am not sure if that will work with exchange picking it up, but maybe it will work ok because you said it does when you paste them in there manually.. I do not really know.. you'd have to try it and edit the email sub routine to use that pickup path
"scripts/emailing_subs_inc.asp" is where you could try editing that path
, Hi all
User activity screen shows history of logged-in users.
Is it possible to view only those users that are currently logged in ? not the all users that have logged in previously
thanks in advance
, Your probably talking about "Session.Timeout" which is a feature of the IIS webserver. Please do a google search on it for more information.
In the meatime if you look at the top of the "check_user_inc.asp" file you should see a section like this where you can try to change the value.
' Minutes you want before the session times out.
' This is set on the server to be default to 15 or 20 minutes depending on the server version
' You can change it there or override it here.
Session.Timeout = 30
Specifying it like that is supposed to overwrite the value for your web in the IIS console which is usualy 20 minutes.
, Encountered another issue. When entering a user name correct but the wrong password get the following error:
Microsoft OLE DB Provider for ODBC Drivers error '80040e14'
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression '(Username = 'ROBERT') AND (Password = 'Z£$'.
/check_user_inc.asp, line 115
Did I do something else wrong?!
Thanks
, How can I make so it goes to certain webpages if user enters valid username and password??
I suppose user enters its information on check_user_inc.asp page, and username and password are stored on SQL database.
Thanks
, Oh also, I tried to run the asp on my machine (win XP) and unless I'm missing something fairly obvious, I cannot get it to run correctly...when previewing it, I see all the code instead of what I should be seeing., well, assuming that function works and is vbscript not vb
(if it is vb code it may need some conversion work)
anyway
in "users/add_new_account.asp"
you would put the code for that function anywhere in the page.. it does not matter where as long as it is in code tags <% %>
then.. right under this part of the same page
If Zipcode_Postal_Code_Required = True Then
If Zipcode_Postal_Code = "" Then
ErrorMessage = ErrorMessage & Server.URLEncode("You need to enter a Zipcode_Postal_Code.\n\n")
End IF
End If
add this
If Check_Postcode(Zipcode_Postal_Code) <> True Then
ErrorMessage = ErrorMessage & Server.URLEncode("You need to enter a Valid Zipcode_Postal_Code.\n\n")
End If
No guarantees but that is the gist of it
cwilliams38381.6456828704, This relates to a part of the new documentation that wasn't ready yet.
I just made a thread about it though.
Here you go.
http://support.cjwsoft.com/forum/forum_posts.asp?TID=198& ; ;PN=1&TPN=1 cwilliams38419.5353587963, Is there an easy way to make this work with reoccurring a monthly or yearly subscription?
, If you are using version 6 CDOSYS is not supported. That is one reason why version 7 came out. If you want to rewrite the code to work with CDOSYS in version 6 that is something you need to sort out on your own as I do not support custimization to the code.
, ya, thats basically what I was gonna do..
BTW.. if that other app is going crazy with an access database it could be the cause of all the slowdown with ASPProtect... what happens there is it is using so much database driver time that it robs other things that also access a database... so basically ASPProtect isn't asking its database for much but your other application and database are cripping that part of the system and causing it to run like crapola
If your other app is using a system dsn try changing it to use a dsn-less connection... it might actually help
, One last thing..
This is bad
http://www.bones.myftpsite.net/rfamilystuff/pictures/
there are .asp files in there people can run that you dont want people running..
u should delete the asp files in there or turn off directory listing...
take care,
CJW
, I dont know about your error on line 6 when uploading..
as far as the manaully edited import file not working I would really need to see it. There has to be somethin wrong with it's format.
I really need more information and possibly acess to the system to do some troubleshooting...
This is anot a feature anyone has ever had an issue like this with.
, I am trying to import a database into my list of registered
users. When I go the import_export_manager.asp page most of the
content is missing. All that appears is the first 2 lines of text
and a box. The rest of the page is blank. I have tried this
under 5 different browsers on 3 different machines and on 2 operating
systems. I also ftp'd the original .asp file with no success. Any
clues?
, Hi Chris,
Thanks for the answer. No, I am not using Paypal since these are employees and sales reps. I guess i'm on my own on this one. :)
Thanks
Sylvain
, It's MS Access, Version 7 (the Full one).
Anyway, I had inadvertently changed the user_id field type to "number". When I changed it back to "autonumber", everything went back to normal.
Thanks you very much for your quick reply and sorry to have bothered you.
, There is nothing built in to the system but it is very doable.
However, you need to be a decent asp coder because your going to have to write some code.
Basically you would want to do a check on the screen where a user uploads to count how many pictures they have uploaded.
Then act accordinly and either let them or dont let them proceed.
On a side note the overall filesize limit of the total of all pictures a user can upload can be set when you edit a user.
, Do what it says so you can see the real error and then post that information here. It could be anything from incorrect permissions to whatever.cwilliams38454.4272916667, An email I just received from eastcoastguy.. to keep this thread up to date
Your quick reply was greatly appreciated... I removed the password and was able to use a DSN...I will look into a DSN-less connection later..once i get this working !
Cheers
eastcoastguy
cwilliams38146.6165509259, You shouldn't be renaming or moving anything... unless you really really understand what you are doing and are at an expert level expert as far as ASP coding goes.
like I said earlier..
http://support.cjwsoft.com/code/code_info.asp?TID=354&ge t=last#1130
redirecting with version 6 is not supported but this thread tells you exactly how to set it up (I showed you this thread in an that earlier post)
http://support.cjwsoft.com/code/code_info.asp?TID=17&KW= redirect
This thread below may also help in case the page you want to start on with a login form should not be password protected..
http://support.cjwsoft.com/code/moreinfo18-2.htm , LOL
, Is there a way to upload photos to individual user directories? I don't want all the picture files in a single directory.
Thanks,
Steve
, Hi,
How do you know permissions are ok in that folder ?
Please tell me more on how they were set.
Please read through my article on how they are set correctly.
http://support.cjwsoft.com/code/moreinfo136-1.htm
Often times they are not set correctly or people thingk they set them somehow but in fact did not do it the correct way.
I would also suggest using the "test_physical_path.asp" page in the "extras" folder to verify if the path you are using to the database mdb file is in fact correct. That page should work whether permissions are set or not. At least then you will know if the path is correct or not and you can go from there.
, Now that I think about you may very well be able to use the existing login_form_inc.asp page
the header and footer files for the users area may be ok as well.
probably the smart thing to do is try your old ones and compare them to the new and see if everything you need is there. If not add it by looking at the source html and comparing.
All other files should definetly be replaced with the new.
, well, so far one other guy found one..
his, was some sort of weird character that was causing a line break or something though in my testing I just couldnt figure out what was going on
now for me to reproduce any error someone find with a password I need to know the key used and the password used
which make it real hard to troubleshoot
,
Timecard Entry: 3/25/2006 4:29:55 PM
Email/Newsgroups/Time Card, Go to Watertown to meet with Jeff W and Troy Decker (23 miles), Steady morning. quality checked sign ups, cancellations, reports, callbacks from voicemail. checked emails. answering phone, taking sign ups , Gisco payroll, MBO bonus, tax deposits, email voice mail, Reset square cam, get mail @imc, etc..., Posted accounts and did a detail of checks and cash for a bank deposit. Stamped invoices for mailing. Made a Post office run. Made the bank deposit. Ans. phone, customer inquiries, worked on problem children, and the bank deposit matching up the invoices with the Quick Books Deposit., check voice mail/email
send hosting agreement and letter to dean richards and cleansmith.com
make chanes for breese cheverolet
go over infomration with dave and tim and jason for proposal
, worked on catt county database, teched phone calls, started Gisco quarterly reports, Lunch, noc, worked on some domain stuff, Two weeks of web billing, went through work order files and gather information for work order log-to enter file into outlook., waites, still steady
, Entered bills, SQL Self-Study, Traffic Reports, Emerald, phones, Lunch, CFM FOODS DEVELOPING SITE, ENTER BILLS, Talked to David Kell of Warren PA BOR about their legal concerns and about 9/5 meeting. Called George and Crispin about the legal issues, then called Dave V to tell him., Setup George w/Adobe Acrobat 4.0 (giscos registered version)., working on new PC Bundle site for Steve, Checked voice / emails & relayed messages. Reading over SONET info. & Reading DSL info for 5/16 class., entered cash deposit and pulled invoices to match, Lunch,