<%@ Page Title="Role-Based Upload Permissions" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %>

<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Role-Based Upload Permissions - AjaxUploader v5.0 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Role-Based Upload Permissions</asp:Content>

<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server">

<div class="demo-card">
    <div class="demo-card-header">Role-Based Upload Permissions</div>
    <div class="demo-card-body">
        <p class="demo-description">
            Restrict uploads based on user roles. Administrators can upload any file type,
            while regular users are limited to images under 2 MB. The server enforces
            role-based rules in the upload handler regardless of client settings.
        </p>

        <au:AjaxFileUpload ID="Uploader1" runat="server"
            AllowMultiple="true"
            AutoUpload="true"
            ShowProgress="true"
            ButtonText="Upload (Role Enforced)" />

        <div class="code-panel">
            <pre><code>&lt;%-- web.config: role-based authorization --%&gt;
&lt;location path="admin/upload.ashx"&gt;
    &lt;system.web&gt;
        &lt;authorization&gt;
            &lt;allow roles="Admin" /&gt;
            &lt;deny users="*" /&gt;
        &lt;/authorization&gt;
    &lt;/system.web&gt;
&lt;/location&gt;

&lt;%-- Upload handler with role-based validation --%&gt;
public class UploadHandler : IHttpHandler, IRequiresSessionState
{
    public void ProcessRequest(HttpContext context)
    {
        bool isAdmin = context.User.IsInRole("Admin");
        HttpPostedFile file = context.Request.Files[0];

        if (!isAdmin)
        {
            // Regular users: images only, max 2 MB
            string[] allowed = { ".jpg", ".jpeg", ".png", ".gif" };
            string ext = Path.GetExtension(file.FileName).ToLower();

            if (!allowed.Contains(ext))
            {
                context.Response.StatusCode = 400;
                context.Response.Write("Only image files are allowed.");
                return;
            }

            if (file.ContentLength &gt; 2 * 1024 * 1024)
            {
                context.Response.StatusCode = 400;
                context.Response.Write("File size exceeds 2 MB limit.");
                return;
            }
        }

        // Admin users: no restrictions
        file.SaveAs(Path.Combine(uploadDir, file.FileName));
        context.Response.Write("{\"fileName\":\"" + file.FileName + "\"}");
    }
}</code></pre>
        </div>
    </div>
</div>

</asp:Content>
