Security exception in HttpPostedFile.SaveAs in medium trust servers

[binujose]

I am trying to access a folder which resides outside the application.My application hosted in a medium trust level server. I am getting error in the below line of code.

brandImage.PostedFile.SaveAs("C:\Temp" + sFileName);

My application is in c:\Inetpub\wwwroot.


Please see the below exception

Security Exception
Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.


Please help....

Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

[gavincannizzaro]

I am trying to access a folder which resides outside the application.My application hosted in a medium trust level server.

The default Medium trust policy grants web applications access only to files in their own virtual directories. See the file %windir%\Microsoft.NET\Framework\%version%\CONFIG\ web_mediumtrust.config. The FileIOPermission is limited to $AppDir$. Your hosting provider is unlikely to grant you access to any other folder.

You have to explicitly grant permission, even to *read* files in the application. I'm still having trouble writing files, and that's how I stumbled onto this thread. I've had success with System.IO.File.AppendAllText, but I have the same problem with HttpPostedFile.SaveAs.

Try some simpler file-write tests first to make sure that you at least have the requisite permissions set, even in your own directory. Your hosting company may provide a web interface that lets you create application-readable and -writeable folders (because you can't do this through FTP to a Windows server).

Good luck!

[jhaxo]

This is interesting. I just did my first web app which accessed files outside the inetpub/wwwroot/app dir. I used cacls to give access to IUSR_machinename and NETWORK SERVICE, as well as IWAM and ASPNET for good measure but I think the last 2 were not needed.

In my case I have access to a test server, and in part because we are behind a firewall, the admin is allowing these changes for the production server as well.