Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...How to restrict file access?How to restrict file access?
Previous
 
Next
New Post
5/8/2010 10:59 AM
 
Hello, I need to restrict users from browsing to files on server. Be it zips, rars, XMLs and many others which contain settings, licences and other sensitive or proprietary stuff. Files has to be denied for user if they are requested externally/directly like browsing to "http://site.tld/file.ext" (I do have disabled directory browsing, but guessing URI is cakewalk). Files still has to be accessible to controls which need or will eventually serve them to users (downloads module etc). I thought of some extension based handler, but no idea where to start. Best if it require no modif in IIS, I'm using DNN 5.4.1 on IIS 7.5 ... I'm looking for right way, not some out of the hat trick :)
 
New Post
5/10/2010 12:52 AM
 
     1. Login in as site administrator, click "Admin - File manager".
     2. In "Folders" drop down list box,select "Secure - Database" ,then enter folder name,  click "Add Folder".
     3. Now when you upload files to this folder, it will be stored in database. Visitors can't retrieve by typing its url like http://www.yourdomain.com/portals/0/securefolder/test.doc.

    You can also select "Secure - File system" while adding folder, dnn will rename files under this folder by add .res suffix. For example ,if your file is test.doc, then it will be renamed as test.doc.res. Because .res is a strict file type in asp.net platform and can't be retrieved. So even visitors type http://www.yourdomain.com/portals/0/securefolder/test.doc.res, they still can't access this file.

Over 20 + professional dnn modules for News Article, Store, Video Gallery, Photo Gallery, Ultra Flash Player,YouTube Video, Image Slide show, Skin Chameleon and much more from DnnModule.com
 
New Post
5/10/2010 1:45 PM
 
This isn't a DNN issue.  First, store such files outside the web hierarchy so they won't be served.  Second, use Windows ACLs to allow or deny access.

Jeff
 
New Post
5/17/2010 1:58 PM
 
I've run into a problem with step #2 in the past.

It appears that if you have an existing folder with documents that you need secured based on Member role on the folder level, you cannot just simply select the drop down list and select Secure - File System or Secure - Database and thus re-assign a folder previously  selected as a Standard - Filesystem.

In other words, i'm noticing DNN is not letting the super user change the Folder Status away from "Standard - File System". Even if you try to re-assign an existing folder away from Standard to Secure and then hit Update, DNN sets it back to Standard.

Is this a Bug, in DNN or am i missing a step?
Please advise as i'm trying to secure existing folders in DNN. I don't want unregistered users or nonmembers to type www.mydomain.com/Portals/0/Member/myd... and gain free access to the kingdom.

Again please advise if there is a work-a-round for re-assigning existing Folders as Secure - File System or Secure - Database.
 
New Post
5/17/2010 2:50 PM
 
folder type can only be configured upon registration. you may move (not copy!) all files to a different location, delete empty folder and recreate it using proper type before moving files back.

Cheers from Germany,
Sebastian Leupold

dnnWerk - The DotNetNuke Experts   German Spoken DotNetNuke User Group

Speed up your DNN Websites with TurboDNN
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...How to restrict file access?How to restrict file access?


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out