We have an image column with images stored on the server.

When the page renders we get this error,

AssemblyVersion: 04.08.04

PortalID: 29

PortalName: .....

UserID: 1

UserName: host

ActiveTabID: 739

ActiveTabName: Home

RawURL: /DesktopModules/UserDefinedTable/MakeThumbnail.ashx?image=%2fPortals%2f.......%2fDashboards%2f1%2f3.jpg&w=200&h=150&PortalId=29

AbsoluteURL: /DesktopModules/UserDefinedTable/MakeThumbnail.ashx

AbsoluteURLReferrer: http://....../ExistingClients/MyDashboard/tabid/855/language/en-AU/Default.aspx

UserAgent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_4_11; en-us) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.2 Safari/525.22

DefaultDataProvider: DotNetNuke.Data.SqlDataProvider, DotNetNuke.SqlDataProvider

ExceptionGUID: 844001b9-70b8-4581-95f8-d05b45e64c6f

InnerException: Unhandled Error: 

FileName: 

FileLineNumber: 0

FileColumnNumber: 0

Method: DotNetNuke.Modules.UserDefinedTable.MakeThumbnail.ProcessRequest

StackTrace: 

Message: System.Exception: Unhandled Error: ---> System.Security.SecurityException: Access denied to e:\inetpub\esvc000013\Portals\.......\Dashboards\1\3.jpg. at DotNetNuke.Modules.UserDefinedTable.MakeThumbnail.ProcessRequest(HttpContext context) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) The Zone of the assembly that failed was: MyComputer --- End of inner exception stack trace ---

 Thanks Sebastian that's the first thing I thought of too... All Users have View Folder permissions on that folder

Any other thoughts?

I use DNN 4.9.0 and the UDT 3.5.1.

On a portal of mine I catch this error "Access denied" so I checked all the permissions on the file system. Since all it's correct I watch into the UDT source code and I found the cause of this strange behavoiur.

Into the file MakeThumbnail.aspx.vb near line 84 there is this code:

            ' If strFilePath doesn't point to a file of the current portal, throw a security exception
            If strFilepath.ToLower.LastIndexOf("\portals\" & PS.PortalId) = -1 Then
                Throw New System.Security.SecurityException("Access denied to " & strFilepath & ".")
            End If

Since my portal HomeDir is "Portals\myportalname" and not "Portals\myportalid" the IF above can't work correctly and always return -1.

I think it's better testing (PS.HomeDirectory) instead of ("\portals\ & PS.PortalID).

Wath do you think about?