I have realised now what the security problem is....
If I use roles to all/deny access to certain files/directories these will be
openly displayed in the web.sitemap file.
As I probably am going to do this, I see this as the only approach to get
Flash to diplay menu's based on the web.sitemap contents.:
i) Make the web.sitemap handler secure so that only the swf file can access
it (how..???)
ii) Program flash to read the handler output, and read a parameter that
indicates the current user role;
iii) Get flash to only display menu items that the current role is allowed
to see.
Item (i) is the real tricky one here....any ideas....??
"JJ" <ab*@xyz.comwrote in message
news:ua**************@TK2MSFTNGP03.phx.gbl...
>I ended up using a handler to allow read access to the web.sitemap file.
When I then tell flash to use the handler in stead of the web.sitemap file
directly, it works.
I cannot think of how this could cause a security problem?? Neither can I
see how allowing read access to the web.sitemap file directly could cause
a security problem...???
"Juan T. Llibre" <no***********@nowhere.comwrote in message
news:%2****************@TK2MSFTNGP04.phx.gbl...
>re:
>>>I think that the reason is that ASP.NET protects some files from direct
access and sitemap is one of them.
That is correct.
re:
>>Would anyone advise changing the suffix of the web.sitemap file?
If the .sitemap is being used by an ASP.NET application,
renaming the sitemap file will make it unavailable to the app.
Would *copying* the web.sitemap file to "web.xml" work ?
Juan T. Llibre, asp.net MVP
aspnetfaq.com : http://www.aspnetfaq.com/
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
"Shimon Sim" <sh**********@community.nospamwrote in message
news:eB**************@TK2MSFTNGP04.phx.gbl...
>>>I think that the reason is that ASP.NET protects some files from direct
access and sitemap is one of them.
Usually you don't want user to see this file directly.
xml files by default are not protected so you can view it from client.
To change sitemap to xml or not is your decision. If it is OK if user
just enters your sitemap file in browser and views it then you can
change it. If it is not OK then you should decide if you want flash to
use this file.
Good luck
Shimon.
"JJ" <ab*@xyz.comwrote in message
news:%2****************@TK2MSFTNGP05.phx.gbl.. .
Although this question involves Flash, I suspect the actual issue is an
asp one..
I am trying to open the web.sitemap file in an .swf file enbedded in an
asp page (I'm working in VS 2005).
I get an error in Flash when it trys to open this file using standard
Flash commands. However when I change the file name and command to
'Web.xml'
it works. (it also works if I don't change the name, but run the swf in
flash player and not via the browser/web server)
I suspect therefore that this is a result of the browser not knowing
what a '.sitemap' file is???
So, how do I open an xml file called 'Web.sitemap' in a web page with
an
embedded .swf???? Would anyone advise changing the suffix of the
web.sitemap file?
JJ
