Hi all

Can anyone tell me the best way to set permissions to allow an ASP
program to write new Html pages to my site's root folder, without
chancing users also being able to write to the root. One ISP told me
this couldn't be done - is IIS really that limited?

I want to be able to suggest to my ISP (based on any advice you can
give) how they should set the permissions to allow a sensible folder
structure -

/mycreatedpage1.htm
/mycreatedpage2.htm ( generated from, say - )
/myfolderwithwritepermssions/mypagegenerator.asp

At the moment, I have to place the newly created pages in the same
'writeable' folder as the 'creator page', like below, which is crap,

/myfolderwithwritepermssions/mypagegenerator.asp
/myfolderwithwritepermssions/mycreatedpage1.htm
/myfolderwithwritepermssions/mycreatedpage2.htm

Many thanks in advance

Kenny

That's probably more a matter of policy than technical capability. You
would have to give the internet user write access to the root of your site -
which they probably don't want to do.

"Kenny Ashton" <ashtonCUTTHIS@ctv.es> wrote in message
news:nduqvvk9mqrhgu8r082ntbog8afne8tpr0@4ax.com...[color=blue]
> Hi all
>
> Can anyone tell me the best way to set permissions to allow an ASP
> program to write new Html pages to my site's root folder, without
> chancing users also being able to write to the root. One ISP told me
> this couldn't be done - is IIS really that limited?
>
> I want to be able to suggest to my ISP (based on any advice you can
> give) how they should set the permissions to allow a sensible folder
> structure -
>
> /mycreatedpage1.htm
> /mycreatedpage2.htm ( generated from, say - )
> /myfolderwithwritepermssions/mypagegenerator.asp
>
> At the moment, I have to place the newly created pages in the same
> 'writeable' folder as the 'creator page', like below, which is crap,
>
> /myfolderwithwritepermssions/mypagegenerator.asp
> /myfolderwithwritepermssions/mycreatedpage1.htm
> /myfolderwithwritepermssions/mycreatedpage2.htm
>
> Many thanks in advance
>
> Kenny
>[/color]

I would simply ask - What is the specific NEED behind this? (What are
you trying to accomplish?) While I understand that you want to create
HTML pages and save them on the server, I wonder why you would ever need
to do this given that the purpose of .asp to dynamically generate HTML
pages as needed. This could be something where the pages created change
each time the .asp page is called or pretty much remains the same each time.

Kenny Ashton wrote:[color=blue]
> Hi all
>
> Can anyone tell me the best way to set permissions to allow an ASP
> program to write new Html pages to my site's root folder, without
> chancing users also being able to write to the root. One ISP told me
> this couldn't be done - is IIS really that limited?
>
> I want to be able to suggest to my ISP (based on any advice you can
> give) how they should set the permissions to allow a sensible folder
> structure -
>
> /mycreatedpage1.htm
> /mycreatedpage2.htm ( generated from, say - )
> /myfolderwithwritepermssions/mypagegenerator.asp
>
> At the moment, I have to place the newly created pages in the same
> 'writeable' folder as the 'creator page', like below, which is crap,
>
> /myfolderwithwritepermssions/mypagegenerator.asp
> /myfolderwithwritepermssions/mycreatedpage1.htm
> /myfolderwithwritepermssions/mycreatedpage2.htm
>
> Many thanks in advance
>
> Kenny
>[/color]

Hi

Thank you for your replies guys, I'm not over experienced, but you
seemed to answer my question with questions.

Are you saying that any 'with permissions' on-site ASP program running
in its own protected folder CANNOT write data to any target folder,
without giving write permissions on the target folder to other users
as well? Surely that would be a ludicrous and illogical security
system, such distinctions can easily be made.

I thought (perhaps mistakenly) that I was using ASP intelligently when
I decided to make those pages based on 'rarely changing' database
content into Html pages. If data changes, say after 3 months, I just
run an update, and I have new pages within seconds. This has saved my
bacon many times, because most of my site stays online when database
development changes provoke DB problems (usually permissions)

I obviously didn't want the ASP based 'Page Creator' program in the
root folder, conversely, I don't particularly want all the pages it
writes to have to reside in the same foldername as the Creator - who
would?

Am I also unusual, in expecting to be able to create and place pages
anywhere I want, within any directory structure I desire,
programmatically - without sacrificing security. I would have thought
that was a prerequisite for any effective file serving system.

Be patient with me guys, I am green, and perplexed as to why so many
simple and obvious requirements seem the most difficult. If you can
tell me how you would achieve this, I will be most grateful.

Best regards

Kenny
[color=blue]
>That's probably more a matter of policy than technical capability. You
>would have to give the internet user write access to the root of your site -
>which they probably don't want to do.[/color]
[color=blue]
>I would simply ask - What is the specific NEED behind this? (What are
>you trying to accomplish?) While I understand that you want to create
>HTML pages and save them on the server, I wonder why you would ever need
>to do this given that the purpose of .asp to dynamically generate HTML
>pages as needed. This could be something where the pages created change
>each time the .asp page is called or pretty much remains the same each time.[/color]
[color=blue][color=green]
>> Can anyone tell me the best way to set permissions to allow an ASP
>> program to write new Html pages to my site's root folder, without
>> chancing users also being able to write to the root. One ISP told me
>> this couldn't be done - is IIS really that limited?
>> I want to be able to suggest to my ISP (based on any advice you can
>> give) how they should set the permissions to allow a sensible folder
>> structure -[/color][/color]

"Kenny Ashton" <ashtonCUTTHIS@ctv.es> wrote in message
news:6htrvvk62tqpo5avs5hhp6588fqu9nnp68@4ax.com...
[color=blue]
> Am I also unusual, in expecting to be able to create and place pages
> anywhere I want, within any directory structure I desire,
> programmatically - without sacrificing security. I would have thought
> that was a prerequisite for any effective file serving system.[/color]

I think you might be if you are expecting ASP to do this for you - a desktop
application, running against the file system on your web server would be the
first
alternative solution that comes to my mind - ASP is inherently a scripting
tool, not a file management tool.

If your pages only change every 3 months, I think writing an app in
something quick to write like VB makes far more sense as it's easier to
achieve without compromising the security of your IIS system - just run it
when you want it to update the content.

"Kenny Ashton" wrote:
: Are you saying that any 'with permissions' on-site ASP program running
: in its own protected folder CANNOT write data to any target folder,
: without giving write permissions on the target folder to other users
: as well? Surely that would be a ludicrous and illogical security
: system, such distinctions can easily be made.

Hi Kenny...

Yes. If you want the anonymous user to be able to have RW rights, then the
anonymous user needs RW rights. Pretty simple. However, I think you have a
misunderstanding to what is required and how it works.

You set aside a directory, NOT accessible by the outside world virtually,
and give the appropriate rights for updates, if you want to allow users to
enter data that will be stored.

Ex.

\wwwroot
\wwwroot\default.asp
\data
\db

Data and db are at the same level as web root so the virtual user
(anonymous) does not have access above the web root and cannot get to these
directories via their browser, etc. They are required to input data and the
data will be inserted/updated by ASP but using their rights. ASP will make
a call to the data file or database by using the physical path which might
be:

d:\inetpub\domain.com\wwwroot
d:\inetpub\domain.com\data
d:\inetpub\domain.com\db

When the data is processed by the ASP processor, it will pass the result
code and any HTML, etc. code to the client (browser) which will then parse
this data and display the results. This means you DO NOT WANT OR NEED WRITE
rights in the root of your web nor should you have them anywhere below that.
You can do it but it requires discipline and can be a security issue. I
would never do it in the root no matter what... or anywhere below that
unless I only referenced that directory sub directory via ASP and it had a
very obscure name. This would not eliminate a brute force attack but
hopefully that would raise some flags if someone was attempting one against
my server.

HTH...

--
Roland

This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose.
-Technet Knowledge Base-
http://support.microsoft.com/default...&ln=EN-US&FR=0
-Technet Script Center-
http://www.microsoft.com/technet/tre...er/default.asp
-MSDN Library-
http://msdn.microsoft.com/library/default.asp

Hi

Thanks for all your replies guys, and easing me along a painful
learning curve. Amazing how if you want to make one web page with
"hello world" on on it, you can teach a kid to do it in 10 mins - when
you want one step beyond that, you suddenly find you needing
considerable knowledge of Windows, IIS, JavaScript, VB, ASP, Html,
CSS, SQL, ......Grrr.

Ha Ha - its just me trying to get OFF the learning curve and produce
something that works!

Dan, thanks, yes the VB approach was the original method, I hated it,
it was a typical modern hybrid, a bag of work-arounds solution.

Roland, thank you for the straightforward assessment and concise
examples.

best regards all

Kenny

"Kenny Ashton" wrote:
: Thanks for all your replies guys, and easing me along a painful
: learning curve. Amazing how if you want to make one web page with
: "hello world" on on it, you can teach a kid to do it in 10 mins - when
: you want one step beyond that, you suddenly find you needing
: considerable knowledge of Windows, IIS, JavaScript, VB, ASP, Html,
: CSS, SQL, ......Grrr.
:
: Ha Ha - its just me trying to get OFF the learning curve and produce
: something that works!
:
: Dan, thanks, yes the VB approach was the original method, I hated it,
: it was a typical modern hybrid, a bag of work-arounds solution.
:
: Roland, thank you for the straightforward assessment and concise
: examples.
:
: best regards all

Hi Kenny...

Yes, it is a learning curve but it was for everyone. I'm sure a lot of us
were wanting to do more than we were capable of, in the beginning, and
possibly a few, like myself, still have that need. The more you do it, the
better you'll get. This is not an analogy I use for politics! (O:=

The benefit you have today is a lot of available code, a better processor,
faster computers, better IDEs, code examples and a lot of people that can
help you. When I started, when dinosaurs roamed the Earth, there was the
manual *cough* and every now and then a book would come out. My favorite
series is WROX Professional: Active Server Pages x.0 (currently I think
x=3). Also, ASP, didn't work as well in 1.0.

Good luck with your coding.

--
Roland

This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose.
-Technet Knowledge Base-
http://support.microsoft.com/default...&ln=EN-US&FR=0
-Technet Script Center-
http://www.microsoft.com/technet/tre...er/default.asp
-MSDN Library-
http://msdn.microsoft.com/library/default.asp

Ok, I believe that you've answered the question that I posed - Why would
you want to create HTML pages when you can use .ASP to create them each
time?

It sounds as if the data seldom changes (every 3 months or so). I would
still recommend using .ASP simply because it would eliminate an
unneccessary step - namely your having to run an update to recreate the
HTML pages. This also ensures that when you leave the pages will
continue to be updated. (I'm quite accustomed to situations where I
carried a huge load of tasks, passed them on and then found out that
within six months most of them had been forgotten.) Keep in mind that
the purpose of technology is to make life easier, not to complicate it
(Paging Mr. Gates, Mr. Bill Gates...).

David H.


*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

Nice anecdotes guys - Thank you for for all the advice and giving me
an insight into how professionals deal with (or more like also have to
put up with) these problems,

Bill is an astute businessman David, now he can afford to keep the
wolves at bay, wouldn't it be wonderful if he made a very human
committment. Just eased up on the profits and spurred MS into period
of technical research and consolidation of existing products, that
would be a real legacy to leave the civilization that have given him
so much - hope Bill responds to his pager (how the hell did you get
the number anyway)

It is fascinating to live in an age when Bill can make enough money to
buy the universe, by selling products which don't work properly, then
charge you for upgrades, then retire the whole product and just keep
restarting the cycle with virtual impunity. Imagine how many legal
firms must haved cursed everytime they crashed and re-booted. Yet the
law says nothing whilst the rest of the world's businesses have to put
up with, sometimes, unreal levels of consumer protection.

Roland, I am an aging ex-PDP DEC engineer, you know, from the days
when you had to fix things, and I do take your points with complete
understanding.

Coding is not my problem, languages have rigidly defined syntax and
rules, which I can learn and understand. But programming seems to be
becoming more of a 'black art' with each new product. There are times
when one line of text in the appropriate file, is actually easier,
both to implement and understand, than working your way through 8
dialog boxes each with 8 tabs, each tab with buttons that call other
dialogs etc, etc.

The introduction of things like 'tri-state' Boolean functions, you
know IsDate() = True, False, or whoops Error, and perhaps the way
Access Addnew/Updates promptly return to the previous record, totally
freak me me out.

I mean, if there 'should' be a date and there isn't, who cares if it
was a null, empty string, ABC or whatever, thats when you write code
to find out why there isn't the expected date - you just want False
returning - as per elementary logic - it aint a date. Instead, I see
thousands of queries on the net, by people trying to find ways round
problems that shouldn't have existed in the first place. I do know a
few good programmers, and not one of them ever had an application
where there didn't need to stay on the record that was just added. I'm
not saying such needs never exist, just that they are so rare they
don't figure.

If you got this far, ignore the rants and thanks again, I'm stuck on a
small island of the West African coast, I must be getting starved of
these stimulating and provoking conversations. Cheers chaps

"Kenny Ashton" wrote:
: Roland, I am an aging ex-PDP DEC engineer, you know, from the days
: when you had to fix things, and I do take your points with complete
: understanding.

You're good. I don't even understand what I write half the time. (O:=

I've been here awhile also. My first computer experience was with a
TeleVideo running CP/M.

--
Roland

This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose.
-Technet Knowledge Base-
http://support.microsoft.com/default...&ln=EN-US&FR=0
-Technet Script Center-
http://www.microsoft.com/technet/tre...er/default.asp
-MSDN Library-
http://msdn.microsoft.com/library/default.asp