Question

I have a page for members to upload files to a folder named UploadedFiles where only administrator of the site can access this folder.

Inside the UploadedFiles folder, there’s a web.config file that has the follwing text:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
            <allow roles="Administrator" />
            <deny users="*" />
        </authorization>
    </system.web>
</configuration>

Is there any work around that allow normal members to upload file to this folder?
What I want is to let users upload files to a secured folder that only administrator can access them.

Answer 1

The restriction to the folders using web.config is applied by IIS/ASP.NET engine.
You can use ASP.NET code behind file to save the files in this folder.

So if you have a FileUpload control in any of the pages, get the file from the control.
Get the path of the UploadedFiles using Server.MapPath(“~/UploadedFiles”) and save the file in this folder.
If the IIS User has access to this folder, it would be able to save it.

Basically this would allow any user to save file to this folder, but only admins to view them.