image permissions

[Torro]

I'm trying to set up an auto-grade testing web site
I need a way to upload questions and images to display to the users who will be taking the tests
What I had planned to do was the following
****************
Create exam database
Create test table (fields are question and imageLink)
Upload questions to test table
If question involves image then
Upload image to test directory and rename to .aspx
Place link to image in imageLink field of that record

When user takes test, use <img src="imageLink> to display the image
***************

The thinking was that since aspx files are protected, then renaming the image file as such would ensure that users would not be able to browse directly and see figures/images before taking the test

I also thought that since the src attribute for images didnt care about the extension, just that it was an image file, that i could get away with this renaming and thus display the image at my leisure without exposing it

unfortunately this did not work, apparently aspx files are hidden in src attributes as well

any help on how this can be done would be appreciated

ps the alternate was to create a directory just outside the webroot with read permission for internet users
i could then place the images here and use the src attribute (this should work right?)
however, i may need to set this up on a different server and that would involve setting directory permissions through some code which i am unwilling to do (especially since the internet user may have different login names on different machines like IUSR INETUSR etc)

 

[oog]

You could always put the images in a directory that is not directly accessible through the web, and have an aspx page open its contents and stream them. The aspx page could do whatever authorization check you want.

 

[Torro]

oog This sounds like my alternate option of putting it in a directory right outside the web server (i know it could be anywhere outside the web directory but less searching = better)
if its not then please expand
i also tried some streaming code
renamed the jpg to .aspx
in another aspx page, wrote code to open file and return jpg stream to output
but anytime i managed to return an image to the browser, i couldn't return anything else, so it'll just be an image
is there some sort of bitmap.AppendTo(OutputStream)?
i was using the bitmap.Save(OutputStream)