In my site, i use the following ASP.NET script to automatically fill a table with the users downloads so that all i have to do to share the files is copy the files into the folder and the script creates the links and does the rest. However, i use Windows security to lockout the files so other users can't access each others files. The problem i have is that the script seems to run as the user NETWORK SERVICE and they have to have permission to list folder contents. To allow my script to work, i have to give this account permissions to see all the files in everybodies folders which means that anyone who knows the username of someone else can see their files. Is there a way to prevent this from happening and force the script to run as the user logged on?
VB Code:
Dim Username as String = Request.QueryString("username") 'Username of the user to whom's files are to be retrieved Dim URLPath as string = "downloads/users/" & Username & "/files/" 'The path that is appended to the files for the hyperlinks Dim DirInfo As New DirectoryInfo("...\Downloads\users\" & username & "\files") 'The directory the files are referenced from Dim fInfo As FileInfo() = DirInfo.GetFiles Dim FileName as String 'Stores the file name so that the spaces can be replaced with %20 for hyperlinks Dim FileSize as Single 'Stores the size of the files so that they can be rounded to two decimal places Dim CreatedDate as Date 'Stoes the date the file was added i.e. the created date
And the rest just sorts the data and puts it into a table.




Reply With Quote