This post originated from an RSS feed registered with .NET Buzz
by Doug Thews.
Original Post: Proper Security for Crystal Reports Export
Feed Title: IlluminatiLand
Feed URL: http://apps5.oingo.com/apps/domainpark/domainpark.cgi?client=netw8744&s=JETBRAINS.COM
Feed Description: A technology blog for people enlightened enough to think for themselves
I uncovered something with the Crystal Reports Export() functionality that I thought
I'd pass along. As you may or may not know, Crystal Reports that comes with VS.NET provides
the capability to export reports to PDF, Word, Excel and many other formats via the method:
myReports.Export()
And, you set up all of the disk file export options like this:
// Get the data for the order and populate the dataset
sqlDataAdapter1.Fill(dsReportOrderDetails);
// Set up a new report based on the Crystal RPT class created
myReportDocument = new ReportOrders();
myReportDocument.SetDataSource(dsReportOrderDetails);
// Set a temporary location for the PDF export
strTempFileLocation = Session.SessionID.ToString() + ".pdf";
// Now set up the export options
myDiskFileOptions = new DiskFileDestinationOptions();
myDiskFileOptions.DiskFileName = Server.MapPath(strTempFileLocation);
myExportOptions = myReportDocument.ExportOptions;
myExportOptions.DestinationOptions = myDiskFileOptions;
myExportOptions.ExportDestinationType = ExportDestinationType.DiskFile;
myExportOptions.ExportFormatType = ExportFormatType.PortableDocFormat;
So, the result of this is that you get an export file called [sessionid].pdf placed in
your current ASP.NET application directory. Because we use Server.MapPath, we don't need
any other priviledges other than to be able to write to our own web app directory.
BUT, Crystal Reports has a little surprise for us. When creating the export, it creates its
own temporary file called TEMP_[originalfilename].pdf and places it in the directory pointed
to by %WINDIR%\Temp. And, since it's using local file access, you need to provide your app
with the ability to write to this directory by either changing the account that your ASP.NET app
impersonates, or by changing the account that the aspnet worker process uses as defined in
machine.config. If you fail to do this, you'll get an annoying exception about not being able
If you're interested in reading more about how Crystal Reports can be used to generate reports
inside ASP.NET apps, please refer to my October Getting Started Column in Visual Studio Magazine
titled
Build Printable ASP.NET Pages.
Previous Topic
