.NET Framework - Framework 1.1 - opening Excel file

Asked By stainless on 10-Aug-12 04:54 AM
Currently, we are opening Excel files using the Response option:

Response.AddHeader("Content-Disposition", "attachment; filename=3D" + lo=

filename is the actual Excel file (contains a macro) and localFileName is a=
suggested name for saving the data file produced.

I am looking at allowing the called Excel to take in command line parameter=
s using a GetCommandLine function in the Excel VBA (have tested Excel code =
tp do this and can read the full command line) but have not found a way of =
changing the C# code above to pass this through. Unfortunately, we are stuc=
k with Framework 1.1 for the time being so need a solution that is compatib=
le. Any ideas?



Jeff Johnson replied to stainless on 10-Aug-12 12:23 PM
Actually, you are not opening them, you are transmitting them.

I doubt this will ever happen, regardless of the .NET framework version.
There may not even be an equivalent of a command line on the client side,
and I also doubt that there is any mechanism to specify switches for it even
if it exists.

Simply put, executing a program to handle the received file is up to the
client (the browser), and has nothing to do with .NET.
Peter Duniho replied to Jeff Johnson on 10-Aug-12 01:31 PM
Indeed, it would be a huge security hole if it did.  There are ways for a
remote system to execute code as a response to receiving specific data, but
those ways _must_ remain solely under the control of the remote system.
Allowing the host of the data to send data and then force it to be handled
in a particular way would open things up completely, allowing any arbitrary
exploit a person wanted to implement.

Of course, if you have control over the receiving end too, then you can add
whatever header you want to the HTTP response (such as one describe
command-line options to use), or even implement a completely new non-HTTP
protocol that provides the functionality you want.

But when you do not have control, you actually _do not have control_. That's
on purpose.  :)