security issue about expose file directory

[=?Utf-8?B?YzY3NjIyOA==?=]

Hi all,

If in an ASP program, I need to display a pdf file link for users to print
and read. Is there any security issue? We are thinking about doing this is
many mail servers block emails with pdf file attachment. We just try to give
an opportunity to users to print the document themselves instead of
completely depending on email delivery.

Thank you.
--
Betty

[Evertjan.]

=?Utf-8?B?YzY3NjIyOA= =?= wrote on 31 jan 2007 in
microsoft.publi c.inetserver.as p.general:

If in an ASP program, I need to display a pdf file link for users to
print and read. Is there any security issue? We are thinking about
doing this is many mail servers block emails with pdf file attachment.
We just try to give an opportunity to users to print the document
themselves instead of completely depending on email delivery.

You van just put the pdf file on the website, and as long as your users do
not divulge the address, it is safe, just as safe as if you send them the
file and they can send it to anyone other.

You could put the file behind a password, using ASP.

Showing the content of a directory is not necessary at all.
You can place a dummy index.asp or switch the IIS to no show.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[=?Utf-8?B?YzY3NjIyOA==?=]

Hi Evertjan,
The pdf file is unique to every user who purchased on our web iste. So it is
not a generice pdf file. Could you explain a little more "Showing the content
of a directory is not necessary at all.

You can place a dummy index.asp or switch the IIS to no show." I don't get it yet.

Thank you.
--
Betty
"Evertjan." wrote:

=?Utf-8?B?YzY3NjIyOA= =?= wrote on 31 jan 2007 in
microsoft.publi c.inetserver.as p.general:

If in an ASP program, I need to display a pdf file link for users to
print and read. Is there any security issue? We are thinking about
doing this is many mail servers block emails with pdf file attachment.
We just try to give an opportunity to users to print the document
themselves instead of completely depending on email delivery.

You van just put the pdf file on the website, and as long as your users do
not divulge the address, it is safe, just as safe as if you send them the
file and they can send it to anyone other.

You could put the file behind a password, using ASP.

Showing the content of a directory is not necessary at all.
You can place a dummy index.asp or switch the IIS to no show.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Evertjan.]

=?Utf-8?B?YzY3NjIyOA= =?= wrote on 31 jan 2007 in
microsoft.publi c.inetserver.as p.general:

>You can place a dummy index.asp or switch the IIS to no show." I
don't get it yet.

[Please do not toppost on usenet]

The pdf file is unique to every user who purchased on our web iste. So
it is not a generice pdf file.

That does not matter, if the pdf file has a location in one of your web
directories, it can be reached from the web if you tell your customer where
it is in a link you sent him.

Could you explain a little more
"Showing the content of a directory is not necessary at all.

Why would it be necessary? Why would you plan to show it?

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Anthony Jones]

"c676228" <be****@communi ty.nospamwrote in message
news:50******** *************** ***********@mic rosoft.com...

Hi Evertjan,
The pdf file is unique to every user who purchased on our web iste. So it

is

not a generice pdf file. Could you explain a little more "Showing the

content

of a directory is not necessary at all.

You can place a dummy index.asp or switch the IIS to no show." I don't

get it yet.

>

Is it important to restrict users to seeing only their reports and not
others?

I'll guess yes.

In that case you definitely will not want to give directory browsing to the
users.

Do these users receiving the email have a username and password they need to
use to access the web site?

If so then email them a link which requires them to enter their username and
password before redirecting to the PDF.

If not then email then some form of security can be acheived by incluing a
GUID in the a link to the PDF.

Anthony.

[Evertjan.]

Anthony Jones wrote on 01 feb 2007 in
microsoft.publi c.inetserver.as p.general:

>
"c676228" <be****@communi ty.nospamwrote in message
news:50******** *************** ***********@mic rosoft.com...

>Hi Evertjan,
The pdf file is unique to every user who purchased on our web iste.
So it

is

>not a generice pdf file. Could you explain a little more "Showing the

content

>of a directory is not necessary at all.

You can place a dummy index.asp or switch the IIS to no show." I
don't

get it yet.

>>

Is it important to restrict users to seeing only their reports and not
others?

I'll guess yes.

In that case you definitely will not want to give directory browsing
to the users.

Do these users receiving the email have a username and password they
need to use to access the web site?

If so then email them a link which requires them to enter their
username and password before redirecting to the PDF.

If not then email then some form of security can be acheived by
incluing a GUID in the a link to the PDF.

A fairly safe way is to use a use-once-web-address.

So the client giving away the address would not be very usefull.

How?

Make an ASP file with an unique name, like
http://domain.xyz/useoncedir/user+pa...thepdfname.asp
Program it to download the pdf using a bitstream,
and immediately, or after a fixed time, say 10 minutes,
delete that asp file. The pdf location is kept secret.

The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/
so that the asp file does not have to exist,
and the virtual asp file could even be named:
http://domain.xyz/useoncedir/user+pa...thepdfname.pdf

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Anthony Jones]

"Evertjan." <ex************ **@interxnl.net wrote in message
news:Xn******** ************@19 4.109.133.242.. .

Anthony Jones wrote on 01 feb 2007 in
microsoft.publi c.inetserver.as p.general:

"c676228" <be****@communi ty.nospamwrote in message
news:50******** *************** ***********@mic rosoft.com...

Hi Evertjan,
The pdf file is unique to every user who purchased on our web iste.
So it

is

not a generice pdf file. Could you explain a little more "Showing the

content

of a directory is not necessary at all.
You can place a dummy index.asp or switch the IIS to no show." I
don't

get it yet.

>

Is it important to restrict users to seeing only their reports and not
others?

I'll guess yes.

In that case you definitely will not want to give directory browsing
to the users.

Do these users receiving the email have a username and password they
need to use to access the web site?

If so then email them a link which requires them to enter their
username and password before redirecting to the PDF.

If not then email then some form of security can be acheived by
incluing a GUID in the a link to the PDF.

A fairly safe way is to use a use-once-web-address.

So the client giving away the address would not be very usefull.

How?

Make an ASP file with an unique name, like
http://domain.xyz/useoncedir/user+pa...thepdfname.asp
Program it to download the pdf using a bitstream,
and immediately, or after a fixed time, say 10 minutes,
delete that asp file. The pdf location is kept secret.

The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/
so that the asp file does not have to exist,
and the virtual asp file could even be named:
http://domain.xyz/useoncedir/user+pa...thepdfname.pdf

One Caveat, I would not send out URL in an email that include the users
name and password. Use a GUID it's unique.

If there is an additonal requirement that we don't want the user to view the
content and then later view it again (or give the URL to someone else to
view which seems a bit draconian to me) then you can still use an ASP file
to deliver the content but limit the time the content can be view after
first use. There is not need of a 404 trick though put the GUID in the
query string to a single ASP page.

[=?Utf-8?B?YzY3NjIyOA==?=]

Hi Anthony and Everjan,
Thank you both for the ideas. I did use GUID to display a unique pdf to a
customer.
In order to hide the real pdf directory,
Here I think I can use Everjan's idea: make that link temporarily and
remove that pdf after like 10- 15 min. and thus we can hide the real pdf
directory.
Can you tell me what is the best way to
"The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/"

Thank you.
--
Betty
"Evertjan." wrote:

Anthony Jones wrote on 01 feb 2007 in
microsoft.publi c.inetserver.as p.general:

"c676228" <be****@communi ty.nospamwrote in message
news:50******** *************** ***********@mic rosoft.com...

Hi Evertjan,
The pdf file is unique to every user who purchased on our web iste.
So it

is

not a generice pdf file. Could you explain a little more "Showing the

content

of a directory is not necessary at all.
You can place a dummy index.asp or switch the IIS to no show." I
don't

get it yet.

>

Is it important to restrict users to seeing only their reports and not
others?

I'll guess yes.

In that case you definitely will not want to give directory browsing
to the users.

Do these users receiving the email have a username and password they
need to use to access the web site?

If so then email them a link which requires them to enter their
username and password before redirecting to the PDF.

If not then email then some form of security can be acheived by
incluing a GUID in the a link to the PDF.

A fairly safe way is to use a use-once-web-address.

So the client giving away the address would not be very usefull.

How?

Make an ASP file with an unique name, like
http://domain.xyz/useoncedir/user+pa...thepdfname.asp
Program it to download the pdf using a bitstream,
and immediately, or after a fixed time, say 10 minutes,
delete that asp file. The pdf location is kept secret.

The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/
so that the asp file does not have to exist,
and the virtual asp file could even be named:
http://domain.xyz/useoncedir/user+pa...thepdfname.pdf

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Dave Anderson]

c676228 wrote:

Hi Anthony and Everjan,
Thank you both for the ideas. I did use GUID to display a unique pdf
to a customer.
In order to hide the real pdf directory,
Here I think I can use Everjan's idea: make that link temporarily and
remove that pdf after like 10- 15 min. and thus we can hide the real
pdf directory.
Can you tell me what is the best way to
"The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/"

Do you know how to use the IIS Management Console to assign a custom script
for 404 errors?

If so, create an empty application -- for example, /UseOnce/ -- on your
website, and assign such a script for that application. In that script,
examine Request.QuerySt ring. It will contain the full requested URL. Now you
can parse it.

In fact, all of the desired DATA in that URL comes after the string
/UseOnce/, so you can strip everything before it out:

URL:
http://your.domain.com/UseOnce/6CA82...0-8C811E45CFB2

JScript:
var Data = Request.QuerySt ring.replace(/.*\/UseOnce\//,"")

vbscript:
Set RX = new RegExp
RX.Pattern = ".*/UseOnce/"
Data = RX.Replace(Requ est.QueryString ,"")

In either example, the variable [Data] contains the string
"6CA825B0-2096-43ED-94E0-8C811E45CFB2". Go from there.

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Evertjan.]

=?Utf-8?B?YzY3NjIyOA= =?= wrote on 02 feb 2007 in
microsoft.publi c.inetserver.as p.general:

Hi Anthony and Everjan,
Thank you both for the ideas. I did use GUID to display a unique pdf
to a customer.
In order to hide the real pdf directory,
Here I think I can use Everjan's idea: make that link temporarily and
remove that pdf after like 10- 15 min. and thus we can hide the real
pdf directory.
Can you tell me what is the best way to
"The whole thing can be made virtual using a custom 404.asp,
catching all requests for:
http://domain.xyz/useoncedir/"

[Please do not toppost on usenet]

In custom 404.asp,
do something like this,
[this actual code not tested debug as required]

<%
qstr = lcase(Request.S erverVariables( "QUERY_STRING") )

'' this is my default picture if I have the link wrong:
if right(qstr,4)=" .jpg" or right(qstr,4)=" .gif" then
response.redire ct "/noPicFound404.g if"
end if

if instr(qstr,"404 ;http://domain.xyz:80/useoncedir/")>0 then
x = instr(qstr,"/useoncedir/")+len("/useoncedir/")
once = mid(qstr,x,99)
strFileName = "/secretfile10293 8/" & once
strFilePath = server.mappath( strFilename)
Set objFSO = Server.CreateOb ject("Scripting .FileSystemObje ct")

ok = false
if once = "file123.pd f" and now<#2007/02/02 23:27# then ok=true
if once = "file456.pd f" and now<#2007/02/03 20:27# then ok=true
if once = "file78A.pd f" and now<#2007/02/03 05:27# then ok=true
''' better use a database but the above is a simple form

if objFSO.FileExis ts(strFilePath) AND ok then
Set objStream = Server.CreateOb ject("ADODB.Str eam")
objStream.Open
objStream.Type = 1
objStream.LoadF romFile strFilePath
Response.Buffer = false
Response.Conten tType = "applicatio n/pdf"
Response.AddHea der "Content-Type", "applicatio n/pdf"
Response.AddHea der "Content-Disposition","i nline;filename= "&once
Response.Binary Write objStream.Read
Response.Flush
objStream.Close
Set objStream = Nothing
else
response.write "Sorry, nonexisting file"
end if
Set objFSO = Nothing
Response.end
end if
%>
<html>
........
This is the 404 page
........
</html>
--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)