Skip to main content

File Manager Security Considerations

  • 2 minutes to read

The ASPxFileManager control stores thumbnails in the folder specified by the ThumbnailFolder property (~\Thumb\, by default). The subfolder structure is based on the source folder’s relative path. The file manager creates thumbnails when they are displayed for the first time. Before creating a thumbnail, the control checks for an existing thumbnail with the corresponding path and name, and if found, uses that thumbnail instead.

The described behavior can cause the following issues:

  • If the file manager creates thumbnails in a public folder, it can result in unauthorized access to thumbnails of private files.
  • If you change the RootFolder property value dynamically, multiple thumbnail images can have the same relative path and file name. In this case, ASPxFileManager may display incorrect thumbnails.


If you implement a multi-user application or dynamically change the root folder, specify the thumbnail folder dynamically based on the current user. We also recommend that you restrict access to each user’s thumbnail folder.

protected void Page_Load(object sender, EventArgs e) {
     string userSubFolder = ASPxComboBox1.Value.ToString();
     ASPxFileManager1.Settings.RootFolder = "~/Content/" + userSubFolder;
     ASPxFileManager1.Settings.ThumbnailFolder = "~/Thumbs/" + userSubFolder;

     FileManagerFolderAccessRule folderRule = new FileManagerFolderAccessRule();
     folderRule.Browse = Rights.Deny;
     folderRule.Path = "~/Thumbs/" + userSubFolder;
<dx:ASPxComboBox ID="ASPxComboBox1" runat="server" AutoPostBack="True" SelectedIndex="0">
          <dx:ListEditItem Text="Common" Value="Common files" Selected="True" />
          <dx:ListEditItem Text="User 1" Value="User1" />
          <dx:ListEditItem Text="User 2" Value="User2" />
          <dx:ListEditItem Text="User 3" Value="User3" />
<dx:ASPxFileManager ID="ASPxFileManager1" runat="server">
     <Settings RootFolder="~/Content/Common files" ThumbnailFolder="~/Content/Thumbs/Common files" />