Member Avatar for anuj_sharma

Hey guys,
in my website the user uploads 3 random files. I've uploaded these in a folder on my machine using the FIleUpload Control. But now i want to give a link to the user to download the uploaded files.
This is what i've done so far:

HyperLink link1 = (HyperLink)DetailsView1.FindControl("HyperLink1");
        HyperLink link2 = (HyperLink)DetailsView1.FindControl("HyperLink2");
        HyperLink link3 = (HyperLink)DetailsView1.FindControl("HyperLink3");
        
        string temp_link = "C:\temp\\";
        string link_query = "SELECT attachment FROM booking_projdetails WHERE emp_bookid='" + getid.Text + "' ";
        SqlCommand link_cmd = new SqlCommand(link_query, myConnection);
        SqlDataReader link_rdr;
        link_rdr = link_cmd.ExecuteReader();
        while (link_rdr.Read())
        {
            int b=0;
            string link_text = link_rdr[0].ToString();
            string[] filesplit = link_text.Split(',');

            string file = "";
            int i = 0;
          foreach (string p in filesplit)
            {

                    if (filesplit[i]!= "" && i<3)
                    {
                        //temp_link += p;
                        if (i == 0)
                        {
                            
                            link1.Text = filesplit[0];
                            link1.NavigateUrl = temp_link + filesplit[0];
                        }
                        else if(i==1)
                        {
                            link2.Text = filesplit[1];
                            link2.NavigateUrl = temp_link + filesplit[1];

                        }
                        else if (i == 2)
                        {

                            link3.Text = filesplit[2];
                                link3.NavigateUrl = temp_link + filesplit[2];

                            
                        }
                        i++;

                    }
                    else
                    {
                        break;
                    }

                }
            }

Please give a solution.

  • 2 Contributors
  • 2 Replies
  • 75 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by anuj_sharma

Dani AI

Generated

Quick diagnosis tied to the code shown by : assigning a filesystem path like C:\temp\file.pdf to a HyperLink will not let the browser download the file. The browser needs an HTTP URL or an endpoint that serves the file. was pointing the right way — make the upload reachable via the web app rather than exposing server filesystem paths directly.

Two practical options: (1) save uploads to a folder under the webroot (for example ~/uploads), store only the filename or an ID in the database, and set links to the virtual path; or (2) keep files outside webroot and expose them through a download handler so you can enforce authorization and logging. A simple ASHX-style handler that looks up a file by ID and streams it back is robust and common:

public void ProcessRequest(HttpContext context)
{
    string id = context.Request.QueryString["id"];
    // lookup safe filename for id in DB; never trust raw filenames from querystring
    string filename = /* lookup by id */;
    string physical = context.Server.MapPath("~/uploads/" + Path.GetFileName(filename));
    context.Response.Clear();
    context.Response.ContentType = "application/octet-stream";
    context.Response.AddHeader("Content-Disposition", "attachment; filename=\"" + Path.GetFileName(physical) + "\"");
    context.Response.TransmitFile(physical);
    context.Response.End();
}

Security notes: store only filenames/IDs in the DB (not full paths), normalize inputs with Path.GetFileName, validate existence and permissions, and restrict allowed extensions. See documentation for Server.MapPath and HttpResponse.TransmitFile for details and refer to OWASP guidance on path traversal prevention.

Recommended Answers

All 2 Replies

Member Avatar for ebookfinder

using your website url and the relative paths to the files from your webroot.

Member Avatar for anuj_sharma

Nice Answer!!!!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.