Tiff Server security update

using System;
using System.Collections.Generic;
using System.IO;
using System.Net;
using System.Web;

/// <summary>
/// The following AquaforestTIFFServerAudit code is designed to check 
/// the filepath is within the allowlisted URLs
/// </summary>
namespace AquaforestTIFFServerAudit
{
    /// <summary>
    /// This code has a hard coded filepath for the AllowList
    /// </summary>
    public class TIFFServerAudit
    {

        /// <summary>
        /// This is a skeleton function, add features as required.
        /// </summary>
        /// <param name="fileName"></param>
        /// <param name="action"></param>
        /// <param name="AUTH_USER"></param>
        /// <returns></returns>
        public static bool securityCheck(string fileName, string action, string AUTH_USER)
        {
            // Add check that filepath is within the AllowList
            // Get the filepath from the filename
            string filePath = Path.GetDirectoryName(Path.GetFullPath(fileName).ToLowerInvariant());

            // If it is not in the allowlist end the response.
            if (!TiffServerAllowlist.InAllowList(filePath))
            {
                return false;
            }
            else
            {
                return true;
            }
            // Return False to disable access
        }
        public static void logAction(string action)
        {
            // Action is one of :
            // VIEW, PRINT, PDF, SAVEPDF, GETANNOTATIONS, SAVEANNOTATIONS, EDIT, SAVEEDIT
            try
            {
                // Get the file path from one of these supplied sources depending upon the supplied Action
                string fileName = HttpContext.Current.Request["FN"];
                if (action == "EDIT" || action == "SAVEEDIT")
                {
                    fileName = HttpContext.Current.Request["filename"];
                }
                else
                if (action == "GETANNOTATIONS")
                {
                    fileName = HttpContext.Current.Server.MapPath(HttpContext.Current.Request["an_url"]);
                }
                else
                if (action == "SAVEANNOTATIONS")
                {
                    fileName = HttpContext.Current.Request["anfile"];
                }

                // Audit operations
                string status = "OK"; // Default
                string auditFileName = (string)HttpContext.Current.Session["ts_audit_file"];

                string PC = HttpContext.Current.Request["PC"];
                string AUTH_USER = HttpContext.Current.Request.ServerVariables["AUTH_USER"];
                string REMOTE_HOST = HttpContext.Current.Request.ServerVariables["REMOTE_HOST"];

                if (auditFileName == null || auditFileName == "")
                {
                    if (!securityCheck(fileName, action, AUTH_USER))
                    {
                        HttpContext.Current.Response.Write($"You do not have permission to {action} this file.{Environment.NewLine}{Path.GetExtension(fileName)}{Environment.NewLine}Please contact your system administrator.");
                        HttpContext.Current.Response.End();
                    }
                    return;
                }

                /* 
                 * Any Security Checks May Go Here and Terminate Response with 
                 * HttpContext.Current.Response.End() before or after writing log entry
                */

                if (!securityCheck(fileName,action,AUTH_USER))
                {
                    if (action == "GETANNOTATIONS")
                    {
                        HttpContext.Current.Response.Write("<ts_annot></ts_annot>");
                        HttpContext.Current.Response.End();
                    }
                    if (PC == "Y")
                    {
                        HttpContext.Current.Response.Write("afPageCount=-5;afMessage='You do not have permission to access this file. Please contact your system administrator.';");
                        HttpContext.Current.Response.End();
                    }
                    else
                    {
                        HttpContext.Current.Response.Clear();
                        HttpContext.Current.Response.End();
                    }
                }

              
                if (action == "VIEW" && PC != "Y")
                {
                    // Only log for the initial page count request, not for each page 
                    return;
                }
    			
                System.IO.StreamWriter auditFile = new System.IO.StreamWriter(auditFileName, true);
                if (auditFile != null)
				{
                    auditFile.WriteLine(DateTime.Now + "," + action+","+status+","+fileName+","+AUTH_USER+","+REMOTE_HOST+","+HttpContext.Current.Request.Url);
                    auditFile.WriteLine();
                    auditFile.Flush();
                    auditFile.Close();
				}
			}
            catch (WebException wex)
            {

            }
			catch(Exception ex)
			{

			}
		}
    }

    /// <summary>
    /// This static class checks if a filepath is included in the AllowList
    /// </summary>
    public static class TiffServerAllowlist
    {
        /// <summary>
        /// Static list of AllowListed locations
        /// </summary>
        private static List<string> _AllowList;

        /// <summary>
        /// Constructor that loads up the allowlist from the filepath
        /// </summary>
        static TiffServerAllowlist()
        {
            _AllowList = new List<string>();

            // This is hard coded to a specified location, it will need to be edited and pointed at a valid text file.
            // The file contains root paths that TifServer is allowed to access.
            string temp =Path.GetFullPath(@"C:\inetpub\wwwroot\tiffserver\AllowList.txt");
            if (File.Exists(temp))
            {
                string contents = File.ReadAllText(temp);
                foreach (string line in contents.Split('\n'))
                {
                    _AllowList.Add(line.Replace("\r", ""));
                }
            }
        }
        /// <summary>
        /// Returns whether the supplied filepath is within the AllowList
        /// </summary>
        /// <param name="filePath"></param>
        /// <returns></returns>
        public static bool InAllowList(string filePath)
        {
            bool result;
            if (_AllowList.Count == 0)
            {
                result = true;
            }
            else
            {
                result = false;
                foreach(string rootPath in _AllowList)
                {
                    if (filePath.Contains(rootPath))
                    {
                        result = true;
                        break;
                    }
                }
            }

            return result;
        }
    }
}

D:\data\project_1\tiffs
D:\data\project_2\tiffs
C:\inetpub\wwwroot\tiffserver\samples