<%@ Page Title="Role-Based Upload Permissions" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %> 
<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Role-Based Upload Permissions - AjaxUploader v5.3 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Role-Based Upload Permissions</asp:Content> 
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server"> 
<div class="demo-card"> <div class="demo-card-header">Role-Based Upload Permissions</div> <div class="demo-card-body"> <p class="demo-description"> Restrict uploads based on user roles. Administrators can upload any file type,
 while regular users are limited to images under 2 MB. The server enforces
 role-based rules in the upload handler regardless of client settings.
 </p> <div class="demo-expect"><strong>What you should see:</strong> the server enforces a role check before accepting the upload - authorization on the endpoint, not a hidden button.</div> <div class="mb-3" style="max-width:240px;"> <label class="form-label" for="roleSelect">Simulated user role</label> <select id="roleSelect" class="form-select"> <option value="Admin">Admin (no restrictions)</option> <option value="Editor">Editor (images, 2MB)</option> <option value="Viewer">Viewer (read-only)</option> </select> </div> <au:AjaxFileUpload ID="Uploader1" runat="server"
 AllowMultiple="true"
 AutoUpload="true"
 ShowProgress="true"
 ButtonText="Upload (Role Enforced)" /> <div class="code-panel"> <pre><code>&lt;%-- web.config: role-based authorization --%&gt;
&lt;location path="admin/upload.ashx"&gt;
 &lt;system.web&gt;
 &lt;authorization&gt;
 &lt;allow roles="Admin" /&gt;
 &lt;deny users="*" /&gt;
 &lt;/authorization&gt;
 &lt;/system.web&gt;
&lt;/location&gt;

&lt;%-- Upload handler with role-based validation --%&gt;
public class UploadHandler : IHttpHandler, IRequiresSessionState
{
 public void ProcessRequest(HttpContext context)
 {
 bool isAdmin = context.User.IsInRole("Admin");
 if (context.Request.Files.Count == 0)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("No file was posted.");
 return;
 }

 HttpPostedFile file = context.Request.Files[0];
 string safeName = Path.GetFileName(file.FileName ?? string.Empty);
 if (safeName.Length == 0)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("Invalid file name.");
 return;
 }

 if (!isAdmin)
 {
 // Regular users: images only, max 2 MB
 string[] allowed = { ".jpg", ".jpeg", ".png", ".gif" };
 string ext = Path.GetExtension(safeName).ToLower();

 if (!allowed.Contains(ext))
 {
 context.Response.StatusCode = 400;
 context.Response.Write("Only image files are allowed.");
 return;
 }

 if (file.ContentLength &gt; 2 * 1024 * 1024)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("File size exceeds 2 MB limit.");
 return;
 }
 }

 // Admin users: no restrictions
 file.SaveAs(Path.Combine(uploadDir, safeName));
 context.Response.ContentType = "application/json";
 context.Response.Write("{\"fileName\":\"" +
 HttpUtility.JavaScriptStringEncode(safeName) + "\"}");
 }
}</code></pre> </div> </div>
</div>
</asp:Content>
<asp:Content ID="ScriptsContent" ContentPlaceHolderID="ScriptsContent" runat="server">
<script> document.addEventListener('DOMContentLoaded', function () {
 var sel = document.getElementById('roleSelect');
 if (window.AjaxUploader && typeof AjaxUploader.getInstance === 'function') {
 var u = AjaxUploader.getInstance('Uploader1');
 if (u && u.options) u.options.headers = function () { return { 'X-User-Role': sel ? sel.value : 'Viewer' }; };
 }
 });
</script>
</asp:Content>
