if I'm generating images using servlets/actions something like this:
byte[] imageBytes = getImageAsBytes();
response.setContentType("image/jpeg");
response.setContentLength(imageBytes.length);
response.getOutputStream().write(imageBytes);
when user access the servlet, where are those images storing? will it download to user temp folder and load it o it's saving user HTTP_SESSION?
domain.com/image/randomImageServlet?param1=a¶m2=b
It isn't stored anywhere except, maybe, in the cache of the browser. Why would you want it to be stored anywhere. You load the bytes in memory, and stream them to the response output stream. They're just downloaded on the wire exactly like your generated HTML is.
Related
I'm a Java developer, absolutely new in BMC Remedy system, but a I have just one fast task to solve.
Our Remedy use Java Applet to upload files from Remedy browser UI to FTP server. I should replace it with Javascript (upload files via http to the server side, which then upload it to FTP server).
In general web application, I can add a servlet, which would receive Multipart file, connect to FTP, upload it and respond with params. Piece of cake.
But is it a right way to solve this problem in Remedy? I've read documentation and it all about some sort of plugins for Remedy Mid-Tier and there is nothing about simple servlets.
What is the right way to solve my task? Any source samples would be really helpful.
Thank you.
if you are doing it via the API, you could just get the record ID, and field ID and do this:
//First, we retrieve the form
int[] fieldIds = {1};
String formName = "My:Form:Name";
//Request ID. Field ID = 1. Always 14 chars long.
String requestID = "00000000000001";
Entry entry = arsConnection.getEntry(formName, requestID, fieldIds);
//add the attachment
AttachmentValue attachment = new AttachmentValue("name_of_file.ext", "path/to/file.ext");
entry.put(550000011, new Value(attachment));
arsConnection.setEntry(formName, newEntry,null,0);
to do this, you need the request id. this code is using the java API.
My asp.net application is in Web Server A and displays and let download MS-Word or PDF documents that are stored in Web Server B.
For security reasons, I was advised to encrypt and decrypt those documents when serving them up on the webserver A.
Could anyone give me some clue on how to do that?
I've never seen some utility before. My code just give value to a link control and let the user to click on it to display a MS-Word or PDF document, like:
Dim RemoteFolder As String
Dim RemoteFileName As String
RemoteFolder = "http://192.168.32.98/Application/Documents/"
RemoteFileName = "MyWordDocument.doc"
lnkOpenDocument.NavigateUrl = RemoteFolder + RemoteFileName
Using SSL might help, that protects all request/responses between the two servers. Otherwise .Net does have a encryption/decryption library under System.Security:
http://support.microsoft.com/kb/307010 also see this previous post What's the easiest way to encrypt a file in c#?
you can always grab the file from the user, encrypt using one of the above methods, and drop the encrypted file on webserver B. when reading it rather than link directly to the .doc file, link to another asp.net page, pass the ID of the file into that new page and have it pull the file from Webserver B decrypt it and display to the user.
I have a webservice through which I can upload documents to our ASP.NET web site.
The problem is when I upload PDF & word documents, they get corrupted when I try to open them. Text documents always upload fine.
What is even strange is that on my development machine, these files upload fine but when I try to upload to our demo site, they get corrupted.
Any ideas?
my code is of the format:
WebServicesSoapClient proxy = new WebServicesSoapClient();
byte[] data = GetFileByteStream("C:\\temp\\sample.pdf");
string response = proxy.UploadDocument("james", "password",
orderId, "Sample.pdf", data, true);
Are your pdf files larger than 4MB? That is the default maximum request length for ASP.NET. You can override that setting in your web.config with:
<httpRuntime maxRequestLength="8192" />
However, be aware that this will increase your memory usage on your server - by default asp.net will cache the entire request in memory.
Also, I'm not entirely certain this is the problem in your case, since normally this exceeding the request length would cause an exception to be thrown - not silent file corruption.
see also http://support.microsoft.com/default.aspx?scid=kb;EN-US;295626
I have ASP.NET application which allows users to download a file when he/she enters a password. I use code below to send file to user:
Context.Response.Clear();
Context.Response.ContentType = "application/pdf";
Context.Response.AddHeader("Content-Disposition", "attachment; filename=" + fileName);
Context.Response.BinaryWrite(File.ReadAllBytes(fileName));
Context.Response.Flush();
Context.Response.Close();
The problem is that the downloads become very slow if the files are more than 1mb or many users are downloading files at the same time. Is it possible somehow to optimize code for better performance?
You might use Response.TransmitFile(/* Your file */); instead of Response.BinaryWrite(/* Your file */);
The TransmitFile()-Method writes the data to the HTTP output stream without storing it in the memory.
Why are you managing the downloads manually? Why not just put a link to the appropriate PDF file on the page that is shown after a successful login? This will free up the ASP.NET threads so you don't use them to manage the file download. IIS will still have to serve them up but I think it would reduce your overhead significantly.
Are you worried about the file name being exposed? If so, reply - there are a few other options you can explore.
Does anyone know a good practice of securing media for asp.net?
I need to host a variety of media that require permission to a view a specific image/video. i.e. a specific user may or may not have permission to view a media file - and this fact may be changed on the fly.
I don't care if they can download a media file that they have access to, I just don't want them to even be aware of items they should not have access to.
I've already considered url obfuscation - this seems quite lame to me.
I have form authenticated users (and I'm not willing to change this).
I would like to keep the media file folder structure unrelated to permissions.
Build an HttpHandler that all media must be accessed through. Then, prior to retrieving the file and sending it down to the user, you can perform any validations that you'd like. Keep all of your media outside of the main wwwroot path, or deny access to that folder using permissions.
More info on this topic here:
http://www.15seconds.com/Issue/020417.htm
I use an xml file like this to set which users/groups have access to a file
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root[
<!ELEMENT file ANY>
<!ATTLIST file name ID #REQUIRED>
]>
<root>
<file name="file.doc" users="155,321" groups="grp5" />
<file name="file2.doc" users="321" groups="" />
</root>
files are stored above http root so they cannot be accessed by URL.
When a user tries to access GetFile.aspx?file=file.doc I load the XML, get the line with
XmlNode xnFile= XML.GetElementById(wantedFile);
, then I call a function
HasAccess(Context.User, xnFile);
Which checks if the user is logged in and compares the permissions, and if it is ok for this user to have the file, I read the files from disk and write them out with
FileInfo thisFile = new FileInfo(secretLocation + wantedFile);
Response.Clear();
Response.Buffer = false;
Response.BufferOutput = false;
Response.ClearContent();
Response.ClearHeaders();
Response.AddHeader("Content-Length", thisFile.Length.ToString());
Response.AddHeader("Content-disposition", "filename=" + thisFile.Name);
Response.ContentType = "application/none";
Response.WriteFile(secretLocation + wantedFile);
Response.Close();
Response.End();
Response.ClearContent();
Response.ClearHeaders();
Actually now I have more than a thousand files, and I think of writing the file data to the database as the XML got corrupted twice in 5 years, probably due to crashes or simultaneous use.
From your comment in the Spikolynn answer
I'm puzzled - how is this different than obfuscation? Would an authenticated user be able to share an image (which they are authorized for) with another authenticated but unauthorized user?
I guess that you try to prevent unauthorized sharing of media.
This is something a lot of companies (Microsoft, Apple, IBM, etc) have put considerable amount of money to solve. The solution was DRM, and now they are removing it, because it failed.
So, my answer is that you can not prevent sharing if the user is willing to put some effort to avoid it.
You can just keep the honest people honest by applying some techniques as Spikolynn or Lusid explain in their answers.
I'd suggest a table holding the files to which each user has access:
UserID int
FileID varchar
then a table for your files:
FileID UniqueIdentifier
FileType char(4) <- so you know which extension to use.
etc...
On the hard drive, name the file the FileID (UniqueIdentifier) and the FileType (the extension, eg. .jpg). The fileID in the permissions table will hold the UniqueIdentifier generated in the other table.
You can pass this via the URL knowing with relative safety that the user won't be able to guess the name of any other file.
Update: this is, by the way, much simpler than writing an HttpHandler or dealing with file permissions. However, while the chances of someone guessing another file name are infinitesimal it is not airtight security as one user may give another one access to the file.
brownpaperpackage.aspx?id={guid}
In the Load event of media.aspx, you verify the user is authenticated, then verify the user has the right to view the media, and if they do, then load the media as a stream and feed it to the page's Response as Spikolynn demonstrated.
Why do it this way? Its simple to code and you get all the benefits of ASP.NET and IIS' authentication services, from which you can find the user requesting the media. Its trivial to map that user to an access list for your media objects. And the Page has the request object right there. You're also hiding the name of the media, so you can't tell what's going on from the URL.
How do you keep people from accessing your media directly? Your media files cannot be stored in the IIS virtual directory. If they are, there's a possibility that they can be downloaded directly. You can store them in a database as a byte array (blob) or store them on disk outside of the web virtual directory. Users must go through ASP.NET to access the files
How do you keep track of what users have access to what media? You keep track of your users thorugh asp.net membership. That means each user has an ID in the aspnet_users table. Create a table for your media with an id and a filename (or a blob containing the actual media). Then you just need to create a third table that connects the two. This table would contain a user id and a media id, signifying this user can view this media. With the user id (from asp.net Membership) and the media id (from the URL) you just need to
select count(*) from UserMedia where UserId = #UserGuid and MediaId = #MediaIdFromUrl
and if the count > 0 the user can view the media.
An example of how you'd use the URL:
<asp:image
runat="server"
ImageUrl="brownpaperpackage.aspx?id=53a2ea4(snip)76ca8b" />