You mean setting these rights or accessing other sites?

I have the same trouble i mean security analyzer giving that call.
The rights setting as we see sould be ok but security analyzer say that they are not ok on a 2016 windows server.

AFAIR the Security analyzer uses a .NET function to find out what file rights it has, but it does not actually check if it can read/write files.
I noticed that sometimes there's a difference between theory and practice.
I have not done any actual file read/write tests on windows 2016 TBH.

thanks for explaining

Timo, your post was extremely useful and it successfully cleared up the directory traversal vulnerabilities on our 2012 R2 servers, but we have encountered an unexpected side effect.

 

Site admins can no longer upload logo and favicons.  File management via the file browser or HTML editor's browse functionality works fine.  It is just the files that are uploaded via the Site Settings page that are not working after we removed the Users group from file permissions.

 

Do you have any insight regarding this issue?

 

Noah, I didn't see which DNNversion you are running, but DNN 9.6.1 and one or two before there have a known issue with the logo and the favicon just as you describe. I looked into it last week. From what I could tell it is ready to be fixed in the next interim release. For work arounds, I have two of them. 1. for the logo, I had some success by uploading the logo using site assets and then using the site settings, in the logo section to "browse file system" for it. Choose it and click "Enter" to save.
2. Although generally not recommended, I found the record in the database where the filename of the site logo is stored and typed in the path and filename of my logo. If you want to try this, I'll go back and figure out which table for you to get into for that for you.

It never occurred to me that this might be a DNN issue and not related to the file security changes we had recently made.  Those files are typically updated rarely, so we hadn't noticed the problem.

Thanks!

Posted By Noah Bast on 06 Jul 2020 01:39 PM

It never occurred to me that this might be a DNN issue and not related to the file security changes we had recently made.  Those files are typically updated rarely, so we hadn't noticed the problem.

Thanks!

Ok, if in the end it is related to the NTFS security, please let me know..

 

For the upload issues, this should now be fixed in 9.6.2 which just got released here: https://github.com/dnnsof.../releases/tag/v9.6.2