Check permissions of directory

Here is a code by Christof Wollenhaupt: (taken from a thread on for profit website):

==============================================

Here's the code. It's a bit more lengthy than the last one that just returns permissions for a file:
Code Snippet
*******************************************
* FUNCTION CheckDirectoryRights(tcName, tuAccess)
* Date : 05/17/2007, 09:33:00
* Author : Christof Wollenhaupt
* Description: Returns .t. or .f. if the user has rights for the specific directory
****** PARAMETERS **************
* Parameters : 2
* Parameter 1: Directory name
* Parameter 2: Which access permissions we want to return
*******************************************
 FUNCTION CheckDirectoryRights ( tcName, tuAccess )
*!* IF hasAccess("C:\directory\","W")
*!* ENDIF
*========================================================================================
* Returns .T. if the current user has the requested privileges for a particular file or
* directory.
*========================================================================================
 *--
 * Build up the Access mask. You can specify a numeric value for other masks
 *--
 Local lnAccess
 Do case
 Case Vartype(m.tuAccess) == "C"
 lnAccess = 0
 If "R" $ Upper(m.tuAccess) && Read
 lnAccess = m.lnAccess + 1
 EndIf
 If "W" $ Upper(m.tuAccess) && Write
 lnAccess = m.lnAccess + 2
 EndIf
 If "A" $ Upper(m.tuAccess) && Append
 lnAccess = m.lnAccess + 4
 EndIf
 If "D" $ Upper(m.tuAccess) && Delete
 lnAccess = m.lnAccess + 0x40
 EndIf
 Case Vartype(m.tuAccess) == "N"
 lnAccess = m.tuAccess
 EndCase 
 *--
 * Declare API functions
 *--
 Declare Long GetFileSecurity in Win32API ;
 String lpFileName, ;
 Long RequestedInformation, ;
 String @pSecurityDescriptor, ;
 Long nLength, ;
 Long @lpnLengthNeeded
 Declare Long OpenProcessToken in Win32API ;
 Long ThreadHandle, ;
 Long DesiredAccess, ;
 Long @TokenHandle
 Declare Long AccessCheck in Win32API ;
 String pSecurityDescriptor, ;
 Long ClientToken, ;
 Long DesiredAccess, ;
 String GenericMapping, ;
 String @PrivilegeSet, ;
 Long @PrivilegeSetLength, ;
 Long @GrantedAccess, ;
 Long @AccessStatus
 Declare MapGenericMask in Win32API ;
 Long @AccessMask, ;
 String @GenericMapping
 Declare Long GetLastError in Win32API
 Declare CloseHandle in Win32API Long
 Declare Long DuplicateToken in Win32API ;
 Long ExistingTokenHandle, ;
 Long ImpersonationLevel, ;
 Long @DuplicateTokenHandle 
 *--
 * Retrieve the DACL
 *--
 Local lcDACL, lnNeeded
 lcDACL = Space(4096)
 lnNeeded = 0
 GetFileSecurity( ;
 m.tcName, ;
 0x7, ;
 @lcDACL, ;
 Len(m.lcDACL), ;
 @lnNeeded ;
 )
 lcDACL = Left( m.lcDACL,m.lnNeeded)
 *--
 * Get the Token for the current security context. That's the user which is logged onto
 * the system or an impersonated user.
 *--
 Local lnToken, lnError
 lnToken = 0
 If OpenProcessToken( -1, 0x0008+0x0002, @lnToken ) == 0
 lnError = GetLastError()
 Return .F.
 EndIf
 *--
 * AccessCheck requires an impersonated token
 *--
 Local lnImpToken
 lnImpToken = 0
 If DuplicateToken( m.lnToken, 2, @lnImpToken ) == 0
 lnError = GetLastError()
 CloseHandle(m.lnToken)
 Return .F.
 EndIf
 *--
 * Create a generic mapping for permissions
 *--
 Local lcMapping
 lcMapping = Space(16)
 MapGenericMask( @lnAccess, @lcMapping )
 *--
 * Check permissions
 *--
 Local lnStatus, lnGrant, lnPLength, lcPBuf, lnOK
 lnStatus = 0
 lnGrant = 0
 lcPBuf = Space(4096)
 lnPLength = Len(m.lcPBuf)
 lnOK = AccessCheck( ;
 m.lcDACL, ;
 m.lnImpToken, ;
 m.lnAccess, ;
 m.lcMapping, ;
 @lcPBuf, ;
 @lnPLength, ;
 @lnGrant, ;
 @lnStatus ;
 )
 lnError = GetLastError()
 *--
 * Close all handles
 *--
 CloseHandle(m.lnToken)
 CloseHandle(m.lnImpToken)
Return m.lnGrant != 0
 

 
 
NaomiNosonovsky at 2007-9-25 > 

Yes, in my tests the results were not always as I expected. I'm not sure why, since this is not my code. I may ask Christof about it.

My own solution was with FSO, but you said you don't want FSO solution. Besides, it doesn't seem to be 100% reliable either.

Look closer at the posted function and at the link, may be you will be able to figure out translation of VB code at that link.

Also I didn't look close enough to this function, but I see it has lots of places it can fail. May be we need to output Last Error information, there is a possibility the function is failing.

NaomiNosonovsky at 2007-9-25 >

> If you go to the share via the drive letter it won't let you save, but 'checkdirectoryrights' returns .T.

That's because you're mixing share permissions and folder permissions. The program queries only file and folder permissions. It's using what you see when you right-click on the directory and open the "Security" tab. It's not checking any additional restrictions that the share imposes. See

http://technet2.microsoft.com/windowsserver/en/library/d043701a-5a2e-4001-b659-0c23c90f76f61033.mspx?mfr=true
http://www.windowsecurity.com/articles/Share-Permissions.html

for more details on share and folder permissions.

--
Christof

ChristofWollenhaupt at 2007-9-25 >