ASP: Hiding file locations by binary stream reading

I do a lot of work with internet content business – companies that earn their living by managing documents and content, either for their own services or on behalf of customers.

Often this involves making documents on the server available for viewing, but without propagating the URL of the actual file, and with permission checks to ensure that the person viewing the file is authorised to do so.

Here’s a simple technique to make a file, such as a PDF, available without revealing the file’s URL and with a security check.

The trick is to binary read the file to the user’s browser, instead of the user opening the file directly. In ASP we do this with the ADODB.Stream object. This allows us to open the file on the web server as a binary stream and send it to the browser. The user will be none the wiser to the file’s location.

' Run a security check
' Add code here to ensure that the logged in user has permission to view the file
' if we have a file identifier
if fileId>0 then
' grab the file's name and location - probably from a database table
sqlStr="SELECT filePath,fileName FROM tblMyFiles WHERE fileId="&request("fileId")
set rs=Server.CreateObject("adodb.Recordset")
rs.cursorlocation=aduseclient
rs.cachesize=1
rs.open sqlStr, conn, adOpenForwardOnly,adLockReadOnly
' if the file entry in our database table is found
if not rs.eof then
' open the file system object
Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
' check the file we want does actually exist
If objFSO.FileExists(filePath&lcase(rs("fileName"))) then
' and if it does exist, then spit out to the browser
' open a binary stream for the file
Set strOutStream = Server.CreateObject( "ADODB.Stream" )
strOutStream.Type = 1 'adTypeBinary
strOutStream.Mode = 3 'adModeReadWrite
strOutStream.Open
' load the file into the stream
strOutStream.LoadFromFile (filePath&lcase(rs("fileName")))
Response.Buffer = TRUE
' use the content type appropriate to the file - here we're using a PDF
Response.ContentType = "application/pdf"
Response.AddHeader "content-disposition", "inline; filename=" & rs("fileName")
Response.BinaryWrite (strOutStream.Read)
Response.End
strOutStream.Close
Set strOutStream = Nothing
end if
set objFSO=nothing
end if
rs.close
Set rs=nothing
end if

Yesterday I wanted to show some SQL code in a blog post, and realised I'd never figured out how some blogs are able to display beautifully formatted, in living colour, code in their posts.

A quick Google and all was revealed: SyntaxHighlighter from Alex Gorbatchev. I then found a handy 'how to' install SyntaxHighlighter into a TypePad blog from Damien Krotkine. Five minutes later I was up and running.

I've spent part of today scoping the screens for a new iPad application for a client. I normally use the wonderful Omnigraffle for this type of thing, so went hunting for iPad stencils for Omnigraffle and found:

• iPad Stencil for Omnigraffle

This worked perfectly (just download, unzip, and place the stencil files into users/library/application support/omnigraffle/stencils.

These guys have a nifty app called Writer that I really must take a closer look now I know that one of my gods Stephen Fry knows its name.

Been battling some Twitter code I wrote a few months ago that first posts a status update to a Twitter account using /statuses/update.json, then allows a user to retweet using /statuses/retweet/[tweetMessageId].json to another Twitter account.

When I tried the routine this morning it steadfastly refused to send the re-tweet. The Twitter api just returned 'Not Found'.

I tore all the routines apart, added debugs everywhere, without success. Then, staring at the returned JSON values, with the database open on another screen, I finally twigged.

When I post the Tweet I'm grabbing the message ID number and saving that to the database. Then, when I want to retweet, I use that message id in the retweet end point.

A couple of months ago the message Ids were 11 digits long, now they are 16 digits. I'd been grabbing the 'id' value coming back from Twitter, but a number that long was getting truncated by my JSON parse routine (I'm using the very handy JSON2 library). I checked the JSON values and Twitter very kindly also sends back 'id_str', which is the message id as a string. For example the JSON contained:

"id":1436631697457152

"id_str":"1436631697457152"

Indeed, now I look more closely, I can see that they also send back the ID of the Twitter account using the same, for example:

"id_str":"112303018"

I guess the explosion in the message Id in the past few months just continues to underscore the remarkable growth in Twitter's scale, presuming the message ID values have simply been incrementing sequentially over that time and haven't been jumped ahead manually for some reason.

Oh what fun. Was updating my theme on one of my WordPress blogs, saved the change, and up came an error page "the requested theme does not exist".

Googled and found someone else with the same problem.

Wound up doing what the commenters suggested – pulled the original CSS from archive, and laboriously had to go through and make my changes again. Easy way to waste half and hour. Alright now though.

Needed to open a big range of ports on Windows Firewall on one of my web boxes. Via the GUI you can only do one port at a time. But run this at the command prompt to add a range:

FOR /L %I IN (5001,1,5201) DO netsh firewall add portopening TCP %I "Passive FTP"%I

This opens ports 5001 to 5201, and names them 'Passive FTP'.

Found this here.

Oh, takes time, like a port or two a second, so if you have a wide range it's going to take some time.