18. februar 2004 - 02:43Der er
3 kommentarer og 1 løsning
Hvordan beskytter jeg et dokument mod uautoriseret download?
På mit webhotel, en Windows IIS, vil jeg gerne kunne beskytte word- og pdf-dokumenter i en bestemt folder mod uautoriseret download. Jeg har allerede et lille login-system, v.hj.a. en access-database, hvor en bruger skal indtaste brugernavn og adgangskode, for at komme ind på siden. Problemet er bare, at hvis nogen nu gætter navn og sti til et dokument, så er det jo bare at skrive denne URL, så bliver dokumentet downloadet/vis. Jeg er ude efter noget a lá ".htaccess" på Apache-server, som kan bruges til at beskytter foldere/filer. .htaccess virker desværre bare ikke på Windows IIS.
Det du basic skal gøre, er at streame din fil til asp: Her er et godt eksempel:
<%@Language="VBScript"%> <%Option Explicit%> <%Response.Buffer = True%> <% On Error Resume Next Dim strPath strPath = CStr(Request.QueryString("file")) '-- do some basic error checking for the QueryString If strPath = "" Then Response.Clear Response.Write("No file specified.") Response.End ElseIf InStr(strPath, "..") > 0 Then Response.Clear Response.Write("Illegal folder location.") Response.End ElseIf Len(strPath) > 1024 Then Response.Clear Response.Write("Folder path too long.") Response.End Else Call DownloadFile(strPath) End If
Private Sub DownloadFile(file) '--declare variables Dim strAbsFile Dim strFileExtension Dim objFSO Dim objFile Dim objStream '-- set absolute file location strAbsFile = Server.MapPath(file) '-- create FSO object to check if file exists and get properties Set objFSO = Server.CreateObject("Scripting.FileSystemObject") '-- check to see if the file exists If objFSO.FileExists(strAbsFile) Then Set objFile = objFSO.GetFile(strAbsFile) '-- first clear the response, and then set the appropriate headers Response.Clear '-- the filename you give it will be the one that is shown ' to the users by default when they save Response.AddHeader "Content-Disposition", "attachment; filename=" & objFile.Name Response.AddHeader "Content-Length", objFile.Size Response.ContentType = "application/octet-stream" Set objStream = Server.CreateObject("ADODB.Stream") objStream.Open '-- set as binary objStream.Type = 1 Response.CharSet = "UTF-8" '-- load into the stream the file objStream.LoadFromFile(strAbsFile) '-- send the stream in the response Response.BinaryWrite(objStream.Read) objStream.Close Set objStream = Nothing Set objFile = Nothing Else 'objFSO.FileExists(strAbsFile) Response.Clear Response.Write("No such file exists.") End If Set objFSO = Nothing End Sub %>
Copy the code above and save it as download.asp on your web server.
To use this code, you link to the page, passing the location of the file you want to send to the user. For example: <a href="download.asp?file=/images/xefteri.gif">
The first part of the code does some basic error checking. The sub DownloadFile checks to see if the file is there, and if it is then it sends it as a binary stream using the ADODB Stream object. The header Content-Length is set so that the browser can properly display the progress bar.
Conclusion Make sure that you have MDAC 2.5+ installed in order for this to work. It would be very easy to add some security to this code. For example, you could combine your database of content access to it. You would then first check if the users have access to content and if they do, only then proceed to send the file to them.
Jeg lukker, da intet af ovenstående kan hjælpe mig. Har i stedet valgt en php-løsning!
Synes godt om
Ny brugerNybegynder
Din løsning...
Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.