<%@ Page Title="Role-Based Upload Permissions" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %> 
<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Role-Based Upload Permissions - AjaxUploader v5.0 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Role-Based Upload Permissions</asp:Content> 
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server"> 
<div class="demo-card"> <div class="demo-card-header">Role-Based Upload Permissions</div> <div class="demo-card-body"> <p class="demo-description"> Restrict uploads based on user roles. Administrators can upload any file type,
 while regular users are limited to images under 2 MB. The server enforces
 role-based rules in the upload handler regardless of client settings.
 </p> <au:AjaxFileUpload ID="Uploader1" runat="server"
 AllowMultiple="true"
 AutoUpload="true"
 ShowProgress="true"
 ButtonText="Upload (Role Enforced)" /> <div class="code-panel"> <pre><code>&lt;%-- web.config: role-based authorization --%&gt;
&lt;location path="admin/upload.ashx"&gt;
 &lt;system.web&gt;
 &lt;authorization&gt;
 &lt;allow roles="Admin" /&gt;
 &lt;deny users="*" /&gt;
 &lt;/authorization&gt;
 &lt;/system.web&gt;
&lt;/location&gt;

&lt;%-- Upload handler with role-based validation --%&gt;
public class UploadHandler : IHttpHandler, IRequiresSessionState
{
 public void ProcessRequest(HttpContext context)
 {
 bool isAdmin = context.User.IsInRole("Admin");
 HttpPostedFile file = context.Request.Files[0];

 if (!isAdmin)
 {
 // Regular users: images only, max 2 MB
 string[] allowed = { ".jpg", ".jpeg", ".png", ".gif" };
 string ext = Path.GetExtension(file.FileName).ToLower();

 if (!allowed.Contains(ext))
 {
 context.Response.StatusCode = 400;
 context.Response.Write("Only image files are allowed.");
 return;
 }

 if (file.ContentLength &gt; 2 * 1024 * 1024)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("File size exceeds 2 MB limit.");
 return;
 }
 }

 // Admin users: no restrictions
 file.SaveAs(Path.Combine(uploadDir, file.FileName));
 context.Response.Write("{\"fileName\":\"" + file.FileName + "\"}");
 }
}</code></pre> </div> </div>
</div> 
</asp:Content>
