Hi,
I am confused on how the write permissions work in asp.net. Is this a huge security bug in IIS 7.5 and Asp.net?
I have a button and the following lines of code. I thought, we have to specify "write" permissions explicitly to the folder/file that we want to write. Even without setting explicit permissions to IUSR, it is creating the file in the specified folder. Why is it so? I checked the "effective permissions" for IUSR to that folder, it does not have any permissions. So, why doesn't ASP.Net restricting "write" access.
protected void Button1_Click(object sender, EventArgs e)
{
File.AppendAllText(@"C:\some-path-outside-appdomain", "It is working");
}
I am using IIS 7.5 and Windows 7.
Application pool: DefaultAppPool
and Anonymous Authentication with IUSR.
Trust Level
: Full
Inf ...
Go to the complete details ...