Permission Denied 1

[TommyB44]

Hi All

I have this ASP script.

<%
Dim objFSO, objCountFile
Dim iCount
Dim I

Set objFSO = Server.CreateObject("Scripting.FileSystemObject")

Set objCountFile = objFSO.OpenTextFile(Server.MapPath("counter.cnt"), 1, True)
If Not objCountFile.AtEndOfStream Then iCount = CLng(objCountFile.ReadAll) Else iCount = 0
objCountFile.Close

Set objCountFile = Nothing
iCount = iCount + 1

Set objCountFile = objFSO.CreateTextFile(Server.MapPath("counter.cnt"), True)
objCountFile.Write iCount
objCountFile.Close

' Write Counter to ASP
Set objCountFile = Nothing
Set objFSO = Nothing
Response.Write ("<CENTER><FONT STYLE='font-size:14xp;border:groove red 4px;color:red;background:white'>") & iCount & ("</FONT></CENTER>")
%>

and it works fine when i test it in IIS XP Pro, But when i run it on Windows 2003 server i get the following.

VBScript runtime error 800a0046

Permission Denied

Anyone have any ideas ?.

Thanks.

 

[WillShakespeare]

You might need to give the IUSR_ServerName account or whichever username you use to access the page, "write" rights on the folder you are creating the counter file.

Will

 

[TommyB44]

Thanks Will

I did that and it works now, one question though, is it safe to do this ? (giving the Users(ComputerName) the option to "write" in the security tab).

 

[WillShakespeare]

It's a standard thing. Obviously giving any permission other than denied is a security risk!

This is why web servers are usually separate machines located on DMZs.

If you are careful and only give permissions for that one folder, and only have that counter file in it, then the worst that could happen is someone may be able to change that file. So, some mean hacker out there might get a kick out of resetting your counter, or making it 20,000,000,000,001!

The alternative is to use a small database (even just add a teable to an existing one if you have one) with a username password access in the root of the web site, and have your page access it, and increase the number in a single row table with the counter.

There are plenty of free databases out there, and of course MS Access is very easy if you have it.

Here is the code I use for ours:

<%@ Language=VBScript %>
<%  Option Explicit %>
<% 
	If Session("visited") <> "yes" Then
	Dim objConn, strSQL, objRS, temp
		Set objConn = Server.CreateObject("ADODB.Connection")
		objConn.ConnectionString = "DSN=pandatabase.dsn"
		objConn.Open
		strSQL = "SELECT * FROM Hits"
		Set objRS = Server.CreateObject("ADODB.Recordset")
		objRS.Open strSQL, objConn, 1 ,3
			temp = objRS("Hits")
			objRS("Hits") = temp + 1
			objRS.Update
		objRS.Close
		Set objRS = Nothing
		objConn.Close
		Set objConn = Nothing
	End If
	Session("visited") = "yes"
%>

No FSO, and maybe a little more code, but not much, and there is no need to change permissions other than the normal web permissions.

hth,

Will

 

[TommyB44]

Thanks Will