Simple but robust web based file management system including user authentication

Imports System.Configuration.ConfigurationSettings
Public Class SQLData
    Implements IWebDriveAPI
#Region "Constructors"
    Public Sub New()
        _SQLHelper = New SQLHelper
        _ConnString = AppSettings("SQLConnection")
    End Sub
#End Region
#Region "Private Members"
    Private _LastException As Exception
    Private _SQLHelper As SQLHelper
    Private _ConnString As String
#End Region
#Region "Properties"
    Public ReadOnly Property LastException() As Exception Implements IWebDriveAPI.LastException
        Get
            Return _LastException
        End Get
    End Property
#End Region
#Region "Routines"
#Region "Implemented Routines"
    Public Function GetUser(ByVal userID As Integer) As DataView Implements IWebDriveAPI.GetUser
        Try
            Dim dtUser As DataTable
            Dim oParms(0) As SqlClient.SqlParameter
            oParms(0) = New SqlClient.SqlParameter("@UserID", userID)
            Dim ds As DataSet = _SQLHelper.GetSQLDataset(_ConnString, "GetUserByID", CommandType.StoredProcedure, oParms)
            dtUser = ds.Tables(0)
            dtUser.TableName = "User"
            If dtUser.Rows.Count > 0 Then
                Dim aRoles As New ArrayList
                Dim dr As DataRow
                For Each dr In ds.Tables(1).Rows
                    aRoles.Add(dr("Role"))
                Next
                If aRoles.Count > 0 Then
                    dtUser.Rows(0)("Roles") = Join(aRoles.ToArray, ", ")
                End If
            End If
            _LastException = Nothing
            Return dtUser.DefaultView
        Catch ex As Exception
            _LastException = ex
        End Try
    End Function
    Private Function GetUser(ByVal userName As String) As DataView
        Try
            Dim dtUser As DataTable
            Dim oParms(0) As SqlClient.SqlParameter
            oParms(0) = New SqlClient.SqlParameter("@UserName", userName)
            Dim ds As DataSet = _SQLHelper.GetSQLDataset(_ConnString, "GetUserByName", CommandType.StoredProcedure, oParms)
            dtUser = ds.Tables(0)
            dtUser.TableName = "User"
            If dtUser.Rows.Count > 0 Then
                Dim aRoles As New ArrayList
                Dim dr As DataRow
                For Each dr In ds.Tables(1).Rows
                    aRoles.Add(dr("Role"))
                Next
                If aRoles.Count > 0 Then
                    dtUser.Rows(0)("Roles") = Join(aRoles.ToArray, ", ")
                End If
            End If
            _LastException = Nothing
            Return dtUser.DefaultView
        Catch ex As Exception
            _LastException = ex
        End Try
    End Function
    Public Function GetUsers() As DataView Implements IWebDriveAPI.GetUsers
        Try
            Dim dtUsers As DataTable
            Dim ds As DataSet = _SQLHelper.GetSQLDataset(_ConnString, "GetUsers", CommandType.StoredProcedure)
            dtUsers = ds.Tables(0)
            dtUsers.TableName = "Users"
            Dim dvRoles As DataView = ds.Tables(1).DefaultView
            Dim drUser As DataRow
            For Each drUser In dtUsers.Rows
                dvRoles.RowFilter = "UserID=" & drUser("UserID")
                Dim aRoles As New ArrayList
                Dim drv As DataRowView
                For Each drv In dvRoles
                    aRoles.Add(drv("Role"))
                Next
                If aRoles.Count > 0 Then
                    drUser("Roles") = Join(aRoles.ToArray, ", ")
                End If
            Next
            _LastException = Nothing
            Return dtUsers.DefaultView
        Catch ex As Exception
            _LastException = ex
        End Try
    End Function

    Public Function AuthenticateUser(ByVal userName As String, ByVal passwordData As String) As WebDriveUserInfo Implements IWebDriveAPI.AuthenticateUser
        Try
            Dim dvUser As DataView = GetUser(userName)
            Dim oUserInfo As WebDriveUserInfo
            If dvUser.Count > 0 Then
                Dim sPublicKey As String = dvUser(0)("key")
                Dim sEncryptedPassword As String = dvUser(0)("password")
                Dim sDecryptedPassword As String = Utility.DecryptTripleDES(sEncryptedPassword, sPublicKey)
                If sDecryptedPassword = passwordData Then
                    Dim sRoles As String = dvUser(0)("Roles").ToString.Replace(", ", ",")
                    oUserInfo = New WebDriveUserInfo(dvUser(0)("username"), dvUser(0)("userid"), dvUser(0)("maxfilesize"), sRoles.Split(","))
                End If
            End If
            _LastException = Nothing
            Return oUserInfo
        Catch ex As Exception
            _LastException = ex
        End Try
    End Function

    Public Function DeleteUser(ByVal userID As Integer) As Boolean Implements IWebDriveAPI.DeleteUser
        Try
            Dim oParms(0) As SqlClient.SqlParameter
            oParms(0) = New SqlClient.SqlParameter("@UserID", GetType(Integer))
            oParms(0).Value = userID
            _SQLHelper.ExecuteNonQuery(_ConnString, "DeleteUser", CommandType.StoredProcedure, True, oParms)
            _LastException = Nothing
            Return True
        Catch ex As Exception
            _LastException = ex
            Return False
        End Try
    End Function

    Public Function UpdateUser(ByVal userInfo As WebDriveUserInfo) As Boolean Implements IWebDriveAPI.UpdateUser
        Try
            Dim conn As New SqlClient.SqlConnection(_ConnString)
            conn.Open()
            Dim oTrans As SqlClient.SqlTransaction
            Try
                oTrans = conn.BeginTransaction
                With userInfo
                    'Update the user information
                    Dim sPublicKey As String
                    Dim sEncryptedPassword As String
                    If .Password <> "" Then 
                        sEncryptedPassword = Utility.EncryptTripleDES(.Password, sPublicKey)
                    End If
                    Dim oParms(4) As SqlClient.SqlParameter
                    oParms(0) = New SqlClient.SqlParameter("@UserName", .UserName)
                    oParms(1) = New SqlClient.SqlParameter("@Password", sEncryptedPassword)
                    oParms(2) = New SqlClient.SqlParameter("@Key", sPublicKey)
                    oParms(3) = New SqlClient.SqlParameter("@MaxFileSize", .MaxFileSize)
                    oParms(4) = New SqlClient.SqlParameter("@UserID", GetType(Integer))
                    oParms(4).Direction = ParameterDirection.Output

                    _SQLHelper.ExecuteNonQuery(conn, "UpdateUser", CommandType.StoredProcedure, False, oParms, oTrans)
                    Dim iUserID As Integer = oParms(4).Value

                    'Clear out the old roles
                    ReDim oParms(0)
                    oParms(0) = New SqlClient.SqlParameter("@UserID", iUserID)
                    _SQLHelper.ExecuteNonQuery(conn, "DeleteUserRoles", CommandType.StoredProcedure, False, oParms, oTrans)

                    'Update the new roles
                    ReDim oParms(1)
                    oParms(0) = New SqlClient.SqlParameter("@UserID", iUserID)
                    oParms(1) = New SqlClient.SqlParameter("@Role", "")
                    Dim sRole As String
                    For Each sRole In .Roles
                        oParms(1).Value = sRole
                        _SQLHelper.ExecuteNonQuery(conn, "UpdateRole", CommandType.StoredProcedure, False, oParms, oTrans)
                    Next
                End With
                oTrans.Commit()

                _LastException = Nothing
                Return True
            Catch ex As Exception
                oTrans.Rollback()
                _LastException = ex
                Return False
            End Try
        Catch ex As Exception
            _LastException = ex
            Return False
        End Try
    End Function
#End Region
#End Region
End Class