Change file summary (title, author, etc.)

[Eric]

Hello,

I am having some sort of security issue with my code. When I change a
file's title in a Windows or console app, I have no problems. (I am using
Microsoft's article & DsoFile.dll:
http://support.microsoft.com/default...b;en-us;224351)

When I run it in ASP.NET, I get a "file not found" exception, even though
the file does exist.

Here is what I have already tried within ASP.NET:
1. Launch the code in a console app in a separate process.
2. Launch the code as a web service...didn' t think this would work since
it's under IIS's jurisdiction as well, but tried anyway.
3. Both of the above two options while impersonating an admin account.
4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly
in my solution).

Here is my code:

Dim oSummProps As DSOFile.Summary Properties
Dim oCustProp As DSOFile.CustomP roperty
Dim sFile, sTmp As String
Dim m_oDocument As DSOFile.OleDocu mentPropertiesC lass

m_oDocument = New DSOFile.OleDocu mentPropertiesC lass
' Note: fileName is just a local file...in this case, c:\test.txt.
m_oDocument.Ope n(fileName, False, _
DSOFile.dsoFile OpenOptions.dso OptionOpenReadO nlyIfNoWriteAcc ess)

If Not m_oDocument.IsR eadOnly Then
oSummProps = m_oDocument.Sum maryProperties
oSummProps.Titl e = myNewTitle
m_oDocument.Sav e()
End If
m_oDocument.Clo se()
m_oDocument = Nothing

Does anybody know what to do here?

Thank you!

Eric

[Patrice]

Likely permissions. See under whihc account runs your app and give this
account the appropriate rights or use another directory...

A tool such as filemon from www.sysinternals.com may help to diagnose file
access problmes in case your configuration should work but still fails...

--
Patrice

"Eric" <Er**@discussio ns.microsoft.co m> a écrit dans le message de
news:33******** *************** ***********@mic rosoft.com...

Hello,

I am having some sort of security issue with my code. When I change a
file's title in a Windows or console app, I have no problems. (I am using
Microsoft's article & DsoFile.dll:
http://support.microsoft.com/default...b;en-us;224351)

When I run it in ASP.NET, I get a "file not found" exception, even though
the file does exist.

Here is what I have already tried within ASP.NET:
1. Launch the code in a console app in a separate process.
2. Launch the code as a web service...didn' t think this would work since
it's under IIS's jurisdiction as well, but tried anyway.
3. Both of the above two options while impersonating an admin account.
4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly in my solution).

Here is my code:

Dim oSummProps As DSOFile.Summary Properties
Dim oCustProp As DSOFile.CustomP roperty
Dim sFile, sTmp As String
Dim m_oDocument As DSOFile.OleDocu mentPropertiesC lass

m_oDocument = New DSOFile.OleDocu mentPropertiesC lass
' Note: fileName is just a local file...in this case, c:\test.txt.
m_oDocument.Ope n(fileName, False, _
DSOFile.dsoFile OpenOptions.dso OptionOpenReadO nlyIfNoWriteAcc ess)

If Not m_oDocument.IsR eadOnly Then
oSummProps = m_oDocument.Sum maryProperties
oSummProps.Titl e = myNewTitle
m_oDocument.Sav e()
End If
m_oDocument.Clo se()
m_oDocument = Nothing

Does anybody know what to do here?

Thank you!

Eric

[Paul Clement]

On Tue, 11 Oct 2005 05:46:02 -0700, "Eric" <Er**@discussio ns.microsoft.co m> wrote:

¤ Hello,
¤
¤ I am having some sort of security issue with my code. When I change a
¤ file's title in a Windows or console app, I have no problems. (I am using
¤ Microsoft's article & DsoFile.dll:
¤ http://support.microsoft.com/default...b;en-us;224351)
¤
¤ When I run it in ASP.NET, I get a "file not found" exception, even though
¤ the file does exist.
¤
¤ Here is what I have already tried within ASP.NET:
¤ 1. Launch the code in a console app in a separate process.
¤ 2. Launch the code as a web service...didn' t think this would work since
¤ it's under IIS's jurisdiction as well, but tried anyway.
¤ 3. Both of the above two options while impersonating an admin account.
¤ 4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly
¤ in my solution).
¤
¤ Here is my code:
¤
¤ Dim oSummProps As DSOFile.Summary Properties
¤ Dim oCustProp As DSOFile.CustomP roperty
¤ Dim sFile, sTmp As String
¤ Dim m_oDocument As DSOFile.OleDocu mentPropertiesC lass
¤
¤ m_oDocument = New DSOFile.OleDocu mentPropertiesC lass
¤ ' Note: fileName is just a local file...in this case, c:\test.txt.
¤ m_oDocument.Ope n(fileName, False, _
¤ DSOFile.dsoFile OpenOptions.dso OptionOpenReadO nlyIfNoWriteAcc ess)
¤
¤ If Not m_oDocument.IsR eadOnly Then
¤ oSummProps = m_oDocument.Sum maryProperties
¤ oSummProps.Titl e = myNewTitle
¤ m_oDocument.Sav e()
¤ End If
¤ m_oDocument.Clo se()
¤ m_oDocument = Nothing
¤
¤ Does anybody know what to do here?

I would agree that there is a permissions problem. It isn't clear though where these files are
located or how you have implemented impersonation in your web application.
Paul
~~~~
Microsoft MVP (Visual Basic)

[Eric]

Thank you for your replies, Patrice and Paul.

I think you two nudged me a little in the right direction...not quite there
yet, but close. I explicitly set the NTFS permissions on the directory to
allow the ASPNET account full access. Now, instead of the "file not found"
exception, I get "System.Unautho rizedAccessExce pÂ*tion: Access is denied." on
the following line of code:

oSummProps.Titl e = myNewTitle

Therefore, I was able to open the file, and it was not read-only. (If you
don't have read/write access, it still opens the file as read-only.)

And Patrice, I took your advice with the filemon...it shows a successful
CREATE request and a successful CLOSE request. Unfortunately, the attempt to
set the title in the line of code above is not logged.

Also, I took the advice of Ken Cox (http://tinyurl.com/7sleo) to change the
ASPNET account from machine to SYSTEM, but that didn't seem to have any
greater effect.

Any other ideas?

Thanks again!

Eric
"Paul Clement" wrote:

On Tue, 11 Oct 2005 05:46:02 -0700, "Eric" <Er**@discussio ns.microsoft.co m> wrote:

¤ Hello,
¤
¤ I am having some sort of security issue with my code. When I change a
¤ file's title in a Windows or console app, I have no problems. (I am using
¤ Microsoft's article & DsoFile.dll:
¤ http://support.microsoft.com/default...b;en-us;224351)
¤
¤ When I run it in ASP.NET, I get a "file not found" exception, even though
¤ the file does exist.
¤
¤ Here is what I have already tried within ASP.NET:
¤ 1. Launch the code in a console app in a separate process.
¤ 2. Launch the code as a web service...didn' t think this would work since
¤ it's under IIS's jurisdiction as well, but tried anyway.
¤ 3. Both of the above two options while impersonating an admin account.
¤ 4. Steps 1 and 2 after fully trusting the assemblies (meaning every assembly
¤ in my solution).
¤
¤ Here is my code:
¤
¤ Dim oSummProps As DSOFile.Summary Properties
¤ Dim oCustProp As DSOFile.CustomP roperty
¤ Dim sFile, sTmp As String
¤ Dim m_oDocument As DSOFile.OleDocu mentPropertiesC lass
¤
¤ m_oDocument = New DSOFile.OleDocu mentPropertiesC lass
¤ ' Note: fileName is just a local file...in this case, c:\test.txt.
¤ m_oDocument.Ope n(fileName, False, _
¤ DSOFile.dsoFile OpenOptions.dso OptionOpenReadO nlyIfNoWriteAcc ess)
¤
¤ If Not m_oDocument.IsR eadOnly Then
¤ oSummProps = m_oDocument.Sum maryProperties
¤ oSummProps.Titl e = myNewTitle
¤ m_oDocument.Sav e()
¤ End If
¤ m_oDocument.Clo se()
¤ m_oDocument = Nothing
¤
¤ Does anybody know what to do here?

I would agree that there is a permissions problem. It isn't clear though where these files are
located or how you have implemented impersonation in your web application.
Paul
~~~~
Microsoft MVP (Visual Basic)

[Paul Clement]

On Tue, 11 Oct 2005 10:04:10 -0700, "Eric" <Er**@discussio ns.microsoft.co m> wrote:

¤ Thank you for your replies, Patrice and Paul.
¤
¤ I think you two nudged me a little in the right direction...not quite there
¤ yet, but close. I explicitly set the NTFS permissions on the directory to
¤ allow the ASPNET account full access. Now, instead of the "file not found"
¤ exception, I get "System.Unautho rizedAccessExce p*tion: Access is denied." on
¤ the following line of code:
¤
¤ oSummProps.Titl e = myNewTitle
¤
¤ Therefore, I was able to open the file, and it was not read-only. (If you
¤ don't have read/write access, it still opens the file as read-only.)
¤
¤ And Patrice, I took your advice with the filemon...it shows a successful
¤ CREATE request and a successful CLOSE request. Unfortunately, the attempt to
¤ set the title in the line of code above is not logged.
¤
¤ Also, I took the advice of Ken Cox (http://tinyurl.com/7sleo) to change the
¤ ASPNET account from machine to SYSTEM, but that didn't seem to have any
¤ greater effect.
¤
¤ Any other ideas?

OK, well I have same two questions as in my prior reply but I will be more specific. ;-)

How did you implement impersonation? Did you enable the option in web.config? Are you impersonating
the authenticated user (via Integrated Windows or Basic auth)?

Where are the files located? Are they on the web server or a remote network machine?
Paul
~~~~
Microsoft MVP (Visual Basic)