Ektron® eWebEditPro Developer's Reference Guide

Security with ASP
The EktronFileIO’s API
Managing Images
If you need to register EktronFileIO, open a command prompt and run regsvr32.
By default, the EktronFileIO.dll is located in the /ewebeditpro5/samples/
asp/database directory under the Web root, but it can reside anywhere on the
server.
Here is the code you would enter to register EktronFileIO.dll if it is in the default
directory.
cd \inetpub\wwwroot\ewebeditpro5\samples\asp\database
regsvr32 EktronFileIO.dll
Licensed owners of eWebEditPro 2.0 and higher may download EktronFileIO.dll
onto their Windows Web server.
The image selection page with the Browse button should validate the file
extension to upload. Security should also be in the ASP page that is the form's
action page.
The ASP page should check the file type and only accept files that are safe, such
as image files with extensions: gif, jpg, or png (see “Validext Element” on
page 432). You may also want to allow document files, such as, doc and pdf
extensions, or media files, such as wav, ram, and asf.
You should not allow ASP or HTML files to be uploaded; a malicious person could
gain control over the Web server and cause damage.
For best security, only allow authorized users to access a page with eWebEditPro
on it. Windows Server provides a user authentication capability.
Alternatively, you could use FTP, which is protected with a password. Image
upload can be disabled altogether on eWebEditPro if needed.
The ASP database sample supplied with eWebEditPro 2.0 and higher includes
an action page, medianotification.asp, to receive uploaded files.
EktronFileIO.dll is a Visual Basic 6.0 utility that allows ASP (and other platforms)
to write a multipart form file upload to the server's file system. The DLL handles
the following tasks:
• Extracts one "uploaded file" from the supplied data stream
• Saves the extracted file to a user-designated directory
• Returns form field values. ASP cannot access a form field if BinaryRead is
used anywhere in the page.
Ektron® eWebEditPro Developer’s Reference Guide, Release 5.1, Revision 1 412