RadAsyncUpload security issue

[Marek Witczak]

First let me post the error I'm getting in logs:

RadAsyncUpload could not create App_Data folder. Ensure the App_Data's location is writable or set the TemporaryFolder property to a writable location.   at Telerik.Web.UI.RadAsyncUpload.CreateAppDataFolder()     at Telerik.Web.UI.RadAsyncUpload.EnsureDefaultTemporaryFolderExists()     at Telerik.Web.UI.RadAsyncUpload.OnPreRender(EventArgs e)     at System.Web.UI.Control.PreRenderRecursiveInternal()     at System.Web.UI.Control.PreRenderRecursiveInternal()     at System.Web.UI.Control.PreRenderRecursiveInternal()     at System.Web.UI.Control.PreRenderRecursiveInternal()     at ....

And here is something about my scenario. I have SharePoint application with some pages containing Telerik controls. Two of the pages contain RadAsyncUpload control. Everything is working fine except situation when I'm browsing two mentioned pages. I receive 403 forbidden error (above I posted what I found in logs). It's worth mentioning that I'm running web application with user account (local admin, not built-in account) as application pool identity and we have Form Based Authentication set up. Even if I try to access the page with administrator account it fails. I've tried to add write permission to app_data folder for app pool identity user but it didn't work. Any other clues what permissions should be set up?
Regards
Marek Witczak

[Kalina]

Hi Marek Witczak,


It seems that the RadAsyncUpload default temporary folder (“\App_Data\RadUploadTemp”) cannot be accessed.
Let me suggest you try setting the RadAsyncUpload TemporaryFolder manually from code-behind to point to a folder that is accessible (for example you can add a SharePoint mapped folder).

Regards,
Kalina
the Telerik team

[Venu]

hello kalina,

It seems that the RadAsyncUpload default temporary folder (“\App_Data\RadUploadTemp”) cannot be accessed.
Let me suggest you try setting the RadAsyncUpload TemporaryFolder manually from code-behind to point to a folder that is accessible (for example you can add a SharePoint mapped folder). 

please let me know briefly with example

very urgent.

[Kalina]

Hi Venu,

I prepared a test VisualWebPart with RadAsyncUpload on it,  and a new folder called “UploadedFiles” at C:\inetpub\wwwroot\wss\VirtualDirectories\80\ on my SharePoint 2010 dev machine.
Then I set the TargetFolder property in this way:

public partial class AsynchUploadTestWebPartUserControl : UserControl
{
    protected void Page_Load(object sender, EventArgs e)
    {
        RadAsyncUpload1.TargetFolder = "~/UploadedFiles";
    }
}

You can download the sample, create the same folder on your machine and test the RadAsyncUpload behaviour.
Please note that you have to add the necessary assembly references in order to build and deploy the WebPart.

Regards,
Kalina
the Telerik team

[Karla]

Still not working for me, any other ideas?
I'm getting the error:

RadAsyncUpload does not have permission to write files in the TemporaryFolder. In Medium Trust scenarios, the TemporaryFolder should be a subfolder of the Application Path.

[Karla]

It works now, I added: RadAsyncUpload .UseApplicationPoolImpersonation = true;

[Mike]

For me the fix was as simple as modifying the directory access permissions at my host to allow the process to have read/write permissions.

See the attached screenshot (from GoDaddy)

[Corey]

I just had the same error. I changed the AppPool user from NETWORKSERVICE to a specific user. Adding the specific user to the IIS_IUSRS group solved the problem for me.

[Miguel]

I resolved the error modifying the directory access permissions to everyone. 

[Arijit]

radFileExplorer.AsyncUpload.TemporaryFolder = Server.MapPath("~/Images/ProductImages/RadUploadTemp/");