Question

I’m deploying an MVC3 app that stores images in a database. The requirement is to do a GET to retrieve the image from the database and then write the image into the response stream. All is working great locally (of course).

I’m using a shared hosting provider (and yes, no Full trust, <trust> is blocked). I am using this ImageResult to return the image:

public override void ExecuteResult(ControllerContext context)
        {
            using (Bitmap bitmap = new Bitmap(width, height))
            {
                using (Graphics graphics = Graphics.FromImage(bitmap))
                {
                    Rectangle displayRectangle = new Rectangle(new Point(0, 0), new Size(width - 1, height - 1));

                    graphics.DrawImage(Image.FromHbitmap(_imageBitmap.GetHbitmap()), 0, 0);

                    context.HttpContext.Response.ContentType = "image/jpg";
                    bitmap.Save(context.HttpContext.Response.OutputStream, ImageFormat.Jpeg);
                }
            }
        }

I’ve tracked down the error to the line where I’m calling graphics.DrawImage(). Here is the stack:

System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
   at TM.Web.ImageResult.ExecuteResult(ControllerContext context)
   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResult(ControllerContext controllerContext, ActionResult actionResult)
   at System.Web.Mvc.ControllerActionInvoker.<>c__DisplayClass1c.<InvokeActionResultWithFilters>b__19()
   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilter(IResultFilter filter, ResultExecutingContext preContext, Func`1 continuation)
   at System.Web.Mvc.ControllerActionInvoker.<>c__DisplayClass1c.<>c__DisplayClass1e.<InvokeActionResultWithFilters>b__1b()
   at System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult)
   at System.Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerContext controllerContext, String actionName)
   at System.Web.Mvc.Controller.ExecuteCore()
   at System.Web.Mvc.ControllerBase.Execute(RequestContext requestContext)
   at System.Web.Mvc.ControllerBase.System.Web.Mvc.IController.Execute(RequestContext requestContext)
   at System.Web.Mvc.MvcHandler.<>c__DisplayClass6.<>c__DisplayClassb.<BeginProcessRequest>b__5()
   at System.Web.Mvc.Async.AsyncResultWrapper.<>c__DisplayClass1.<MakeVoidDelegate>b__0()
   at System.Web.Mvc.Async.AsyncResultWrapper.<>c__DisplayClass8`1.<BeginSynchronous>b__7(IAsyncResult _)
   at System.Web.Mvc.Async.AsyncResultWrapper.WrappedAsyncResult`1.End()
   at System.Web.Mvc.MvcHandler.<>c__DisplayClasse.<EndProcessRequest>b__d()
   at System.Web.Mvc.SecurityUtil.<GetCallInAppTrustThunk>b__0(Action f)
   at System.Web.Mvc.SecurityUtil.ProcessInApplicationTrust(Action action)
   at System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)
   at System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
The action that failed was:
LinkDemand
The type of the first permission that failed was:
System.Security.Permissions.SecurityPermission

I’m aware also that using GDI+ on the web is not exactly supported. Are there better ways to do this? Or at least a way that won’t trip the Partial Trust? Much obliged.

Answer 1

Well, it turns out I was over complicating this. I found this good post that explained why I couldn’t just save the bitmap from the database to the output stream.

That led me to try to eliminate the GDI+ call. I ended up with this that works beautifully (_imageBitmap has been pulled from the db):

public override void ExecuteResult(ControllerContext context)
{
    using (Bitmap bitmap = new Bitmap(_imageBitmap))
    {
            context.HttpContext.Response.ContentType = "image/jpg";
            bitmap.Save(context.HttpContext.Response.OutputStream, ImageFormat.Jpeg);
    }
}