NTFS and Web permissions on iis 6

chalky

I am currently working on a document server and am having problems with permissions on directories.
I want to be able to display pdf documents within my web pages, but stop people from browsing directly to them, what permissions do i have to set to do this.

thanks for any help.

regi

The thing to look for is 'Directory browsing' - just turn that off perhaps?

chalky

thanks, but I've already tried that, but its still possible to open the PDF document if you have the full url.

regi

Ok, I misunderstood by what you meant by displaying them. Unless you feed the user byte-by-byte the PDF with the correct mimetype set, you'll probably need to allow the users to view and thus download them.

How do you mean for users to view the PDFs?

seamus

chalky wrote:

thanks, but I've already tried that, but its still possible to open the PDF document if you have the full url.

As regi says, to avoid users finding out where the document is, you'd have to write a script which feeds the document to them byte-by-byte. That's not overly difficult, but a little pointless unless you really don't want them to be able to call up the documents directly.

Nietzschean

to avoid direct linkage the simplest thing can be to just put in a htaccess file which requires the referrer to be from the same domain. Its easily beatable by someone who know's what they are doing, but for the OP's purposes i'd say it'd do nicely

Though this being IIS and not apache i imagine some sort of ISAPI filter can probally achieve the same effect...

Kernel32

If it's IIS and .Net then a HttpHandler will do what you need.

chalky

Thanks all.
I wrote the script to feed the document byte by byte. It seems to work well. Thanks for all the help.