Below are the TWO APPROACHES I FOLLOWED TO UPLOAD FILE TO A FOLDER.
I have a page where it can be used to upload a file to the webserver (a folder resides in the wwwroot) and then i give the facility to the user to view it . After that user can save it to the database and the file is deleted from the folder. But when I do this anyone who can browse and have the write facility to this folder can delete or read files. This is an unaccpetable security loop hole.
The second way that i tried was to have a dedicated physical path other than the wwwroot eg:/ D:/Material/ and this is kept in the web configuration file. Then i upload the file and write it here. Then I write the file to DB. Here I face two problems. 1. How i can give the user to view the file soon it is uploaded and before saving to database. Since I cant use Server.MapPath() I cant do this. 2. Again even if I found a way to view the file anyone who can access th ...
Go to the complete details ...