Map Drive
C#
Server and Client are on the same network
I am building a small software for laboratory. Tests are requested and laboratory technicians perform the tests, and enter the results, and the software creates reports, transforms them to pdf, and saves them on the server in a folder called archive, so that when doctors log onto the software, they can see the files in a form with a grid in it. And only from that form, the files can be opened.
Everything works fine, but I need to restrict the access to the file called archive so that users can not access it manually. I only need my software to be able to access it.
So what I intend to do is that once the client software logs onto the server software, I want the server software to send a username and password to the client software that remains hidden from users. Because only the client software should be able to create, delete, and change files in the archive folder located on the server.
How can I put a username and password on that file ? Do I need to create an account on the server ? Or is there another way to do this ?
I would recommend against working with passwords. You don't wish to store them, handle changes and risk them getting out. If something is available to the client program, it's generally available to the users. You can't trust the the client or the user.
Why not let the server have access to the folder? Don't give users any permissions on the archive folder but have the client send the files to the server (by adding this option to the server's API). The server can validate the user as legitimate (using your own authentication and authorization, if you have any) and that the files appear OK and then place them inside the Archive folder. That way only the user running the server process has access to the folder and you don't have to mess around with passwords and accounts.
Another idea, if you do not wish to change the API with the server too much. Create another folder, which users will have access to. The client will upload the files to this folder. The server could scan the folder periodically or get notified about the file from the Client, check the file and move it to the protected Archive folder.
Related
I am trying to run a macro-file that will be present in users desktop via my .net website, hence I would like to know how I can get the path of that macro file in my code and open it.
I am currently using following described code to get the path, and I think that this must be trying to take the path from server computer but I would like to get this from users computer, this particular macro file will open internet explorer and navigate to certain website and download a report to local computer hence I would like this to be run from users side.
string path = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
Is it possible to get the path automatically or should i get that from user.
please provide suggestion.
You are hosting a website, which is using a web server like IIS and the user access the site using a browser like edge, chrome, now the file is in user desktop, so the main question remains,
Does the browser process have the access to the file system of the user
Mostly no, especially not via the call Environment.GetFolderPath(Environment.SpecialFolder.Desktop);, this will be good for running it on hosted sever, where w3p.exe process is accessing the file system with required permissions
For the end user desktop
You need to provide the file dialog box, let user select the file / directory and need to plan to serialize the file to the sever (upload) for doing any processing. You can binary serialize the file using a provider like protobuf, msgpack to achieve the necessary functionality
Code you have provided, is good for for the process where you have direct control, like Console, WPF, which runs on the system under certain permission and thus access the file system for processing
I was thinking to dump an XML file generated from server to a random client requesting that. The problem is that I have to damp that file in a specific folder of clients (C:/Application/POSMachine/WaitingXML), for there is another application listening to that folder.
My approach:
A simple patch (to change chrome download address to the specific desired path)
Installing windows service/local-api for those clients who need this feature, and passing server-side generated XML to clients installed service/api, I am assuming I will get clients IP-address from the server and hit the service hosted in clients.
Request.GetOwinContext().Request.RemoteIpAddress
Any comments and better implementation is appreciated.
It would be a security risk to allow a website to download a file to an arbitrary location (that would mean a malicious website could just download a new svchost.exe to C:\Windows\System32 or what not)
Also your idea with running a service would not work in all cases, since your clients will most probably be behind a modem/router/NAT switch (or multiple). All these devices would have to be configured for port forwarding. So, you really need an 'client-outbound' connection (like a browser does).
I would implement a client program which can contact your server and download the file with a System.Net.WebRequest and save to the specific location. Another possibility might be to add a System.Windows.Forms.WebBrowser control and handle the FileDownload event. However, your question does not contain enough information to more specific (how does the client chose a file to download)
I am developing a windows form program in C# .Net and I need it to read and write files from/to a folder on a computer (let's name the computer SERVER_PC) on the wireless network which connects only 5 PCs. Basically, users should not even know about the files outside my program. I mean they shouldn't' read or write files to SERVER_PC directly. only the program should be able to connect to that folder on SERVER_PC and open the files for them.
DO I need to create a home group just for this purpose? Is this a secure way of handling it? Can I grant (read, write) permissions only to my program?
I am running windows 7 on all network PCs
(NOTE: We don't want to use domain controller for this.)
I really appreciate your help. thanks a lot
You could have a server app and a client app that transfer files using tcp sockets.
The server could provide a list of filenames to the clients. The clients could then request a file or files, the server then sends them then the user could save them back effectively sending them back to the server app which would then save them.
You could then restrict access to the folders to the user the server app runs under.
You would need to handle issues with more than one person working with a file though, unless you gave each user their own folder.
if you wanted to get more secure, you could encrypt the streams being sent between tcp end points.
I have an input MDB file coming from a third party program. I have to read it in my asp .net application and then ask some related form to the final user.
At the moment, I can write the mdb file on the filesystem and read it, it works but sometimes this feature doesn't work and I have to restart the server.
The customer want to externalize the server and I can't write to the file system or even restart it so I'd like to read the mdb file in asp .net from a MemoryStream or maybe execute a conversion to a most readable format like XML, but I don't think it is possible.
So I'm looking for a solution to preprocess the access file.
I don't think it is possible to read it via javascript (only vbscript).
The only way I imagined is :
call a special application with a url code like app://id the id is transmitted to a special application on the desktop, he will select his file and the content will be transmitted to the web app via web service
after that the person should click on a button and he can process the different form associated with that data
that sounds me complicated for the final user
does someone have some feeling or idea about that case ?
Edit
The mdb file is uploaded via a http form contained into the web form.
Sometimes, after the upload, the application throw an exception and it can't use the c:\windows\temp. I have an error : Access not possible on the specified file.
I don't have a better information because the application is located in the internal network of the customer and I'm not there. So I have to ask them to reboot it.
Quote: Configuring Permissions for an Access Database
When a Web application uses an Access database, the application must
have Read permission to the .mdb file so the application can access
the data. Additionally, the application must have Write permission to
the folder that contains the .mdb file. Write permission is required
because Access creates an additional file that has the extension .ldb
in which it maintains information about database locks for concurrent
users. The .ldb file is created at run time. [...]
Therefore, to use an Access database in an ASP.NET Web application,
you must configure the folder that contains the Access database to
have both Read and Write permissions for the local ASPNET user
account.
In other words, if you have no permissions to read and write you will not be able to work with .mdb.
There are following options available
If permissions cannot be done due to security reasons, but your web server has an access to the .mdb file location (both located in same network) then your client could setup a scheduled job which will backup/copy .mdb to another location where asp.net could have permissions to work with .mdb. This however will be a problem for syncing backup .mdb to production .mdb.
Setup a webservice to update .mdb. It will be hosted on the server where .mdb is located and will have all required permissions. Your application will work with .mdb through the webservice and does not require any permissions on .mdb.
Replace .mdb with SQL Server Express
I have a website that occasionally needs to have a handful of the tables in its database updated. The updates come from another system that exports to comma delimited text files. I can then either FTP the text files to the web server, send them in through an admin upload page, or manually log in to Remote Desktop to download the text files. I have all my C# code written to parse the files, check the database contents, and decide what to do.
Should I code the sync logic to be part of a file upload page, protected in the admin section of the site or should I create a Windows Service that constantly looks for files to process in a particular directory that I can drop files in through FTP?
I have used Windows Services in the past and they have worked great, but if I ever have to make a change to the code it can take longer than it would if I just had to modify an ASPX.
Are their security benefits one way or another?
Performance benefits?
ASPX page wins the "ease of maintenance" category.
I would create a Windows Service to watch a secure folder and use a directory watcher to look for new files. Since the files are coming from another system, it is asynchronous in nature, and it is much more performant to have a Windows Service running separately to watch for updates as they happen. It can also parse the files and update the database for you.
Depending on who maintains the remote system, the easiest way is to grant permission to the service to access the files on a secure, shared folder. Then you won't need to do anything manually.