Image.Save(string) Security permissions

[walid]

Hi all,

I was wondering if anybody knows why Image.save(pathstring) is allowed in
ASP.net without any security permissions . the user can create an image and
save it in the web page directory, but if we try to write a file to hard
disk in asp.net it needs permission. Isn't it less secure to allow images to
be saved?

Any feedback is appreciated
thnx

 

[Hayato Iriumi]

Hello walid,

As long as the user that aspnet worker process runs under has a permission
to write to certain directory, it does. It all depends on how you set it up.

 

[walid]

Yes, but how come if you are using the default security settings, the
image.save (string path) is allowed but IO stream write is not.

regards

 

[Jon Skeet [C# MVP]]

Yes, but how come if you are using the default security settings, the
image.save (string path) is allowed but IO stream write is not.

I believe it is - it just depends on where you're saving it to, and
whether the ASP.NET process has permission to write there.