Traverse folder access rights vs Dot.Net framework

Hi All, I am having a bit of trouble. I hope someone knows the way through this...

I have a 2003 server share for example\\server1\share1\dir1\dir2\dir3\file1.txt

I have a AD group Group1. Group1 has read access to the share share1 on server server1.

Group1 also has read access at the dir3 and file1.txt level.

Group1 has Traverse folder / execute files access to dir1 and dir2. They do not have read / list access to dir1 and dir2.

Which mean Group1 can not browse in explorer to dir1 and beyond. They can only get to \\server1\share1. They can see dir1 though.

But they can jump to dir3 and beyond by pasting the full path into explorer's address bar.

So far so good. Everything works as expected...

In a small c# version 2.0 framework program there is a streamreader object trying to access file1.txt

like thisStreamReader sr =newStreamReader (@"\\server\share1\dir1\dir2\dir3\file1.txt");

When the line executes it throws an access denied exception.

Finally, my question:

Obviouslythe framework is trying to walk down file path instead of jumping directly to the full path.

Does anyone know how to get the framework to jump directly to the target file?

I know that what I am doing is a bit obtuse. The program is designed this way for a reason.

The users should not know that the program is accessing file1, or where file1 is actually stored.

They should not be able to browse to the file, but the program (when running under their login) should be able to access the file.

Thanks for your help...

Keith

[3192 byte] By [KeithVinson] at [2008-1-4]
# 1

Yes you must be able to traverse the folders in this case (AFAIK). Part of the reason is that .NET builds up the folder names as it goes along to ensure that you don't try to generate invalid paths. Internally it relies on Win32 for file validation so it is probably Win32 that is complaining.

In reality traversal checking is related to network security anyway. By default it is disabled but group policies allow you to turn it on. Irrelevant of what you do it is really easy to see that a program is using a particular file (or even get the files that a program is using). Therefore hiding the folder from the user is not really providing you anything beyond more work. You can lock down the folder structure so the user can only read (and not execute) the files but that is about it. IMHO.

Michael Taylor - 5/29/07

http://p3net.mvps.org

TaylorMichaelL at 2007-9-25 > top of Msdn Tech,.NET Development,Common Language Runtime...

.NET Development

Site Classified