Image.Save(stri ng) Security permissions

[walid]

Hi all,

I was wondering if anybody knows why Image.save(path string) is allowed in
ASP.net without any security permissions . the user can create an image and
save it in the web page directory, but if we try to write a file to hard
disk in asp.net it needs permission. Isn't it less secure to allow images to
be saved?

Any feedback is appreciated
thnx

[Hayato Iriumi]

Hello walid,

As long as the user that aspnet worker process runs under has a permission
to write to certain directory, it does. It all depends on how you set it up.

Hi all,

I was wondering if anybody knows why Image.save(path string) is allowed
in ASP.net without any security permissions . the user can create an
image and save it in the web page directory, but if we try to write a
file to hard disk in asp.net it needs permission. Isn't it less secure
to allow images to be saved?

Any feedback is appreciated
thnx

[walid]

Yes, but how come if you are using the default security settings, the
image.save (string path) is allowed but IO stream write is not.

regards

"Hayato Iriumi" <hi*****@hotmai l.com> wrote in message
news:33******** *************@n ews.microsoft.c om...

Hello walid,

As long as the user that aspnet worker process runs under has a permission
to write to certain directory, it does. It all depends on how you set it
up.

Hi all,

I was wondering if anybody knows why Image.save(path string) is allowed
in ASP.net without any security permissions . the user can create an
image and save it in the web page directory, but if we try to write a
file to hard disk in asp.net it needs permission. Isn't it less secure
to allow images to be saved?

Any feedback is appreciated
thnx

[Jon Skeet [C# MVP]]

walid <wk*******@hotm ail.com> wrote:

Yes, but how come if you are using the default security settings, the
image.save (string path) is allowed but IO stream write is not.

I believe it is - it just depends on where you're saving it to, and
whether the ASP.NET process has permission to write there.

--
Jon Skeet - <sk***@pobox.co m>
http://www.pobox.com/~skeet
If replying to the group, please do not mail me too