Question

Ive just tryed some things out with my new server today, and ive found a big flaw in what ive done in my MVC application.

So what happening in applikation is : people can access page and login, when people login , they can upload files in their own folder on a server. and then they can access them when they want. but the problem ive found is: people can see any folder they want if the enter right url. for example :

URl can be named like : testnameweb.com/Upload/testUserName/testfilename.png
in this case the one who enters url, can see testfilename.png file. BUT, if same person enters :
testnameweb.com/Upload/

they acan see any people folders and browse on server any way they want.

Any idea how to prevent this?

Answer 1

The first step would be to put those files into a folder which is not publicly accessible. For example App_Data. Or a folder that’s completely outside of the application root. Then you could organize your files into folders per user. So each user will have his own sub-folder. Then you could write a controller action to which you will only pass the filename and which based on the currently authenticated user will server the proper file.

[Authorize]
public ActionResult File(string filename)
{
    string username = User.Identity.Name;
    // now that you know the currently connected username and the filename
    // go and find the corresponding file and stream it as a result
    ...
}

And to provide a link so that the currently connected user can browse a file:

@Html.ActionLink("Open foo.txt", "file", new { filename = "foo.txt" })