Telenet Cloud Online Help

Why is "parent path" not allowed on IIS7/IIS8? Why do I get an error with disallowed parent path?

Parent path is not allowed on iis7 and an error with disallowed parent path will appear


Parent path is not allowed on iis7 to prevent people from doing forbidden things. Below you will find a quote from microsoft:

"Parent paths can potentially be a security vulnerability if a path is escaped. It would also depend on how your site content is structured."
"The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the .. otation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application."

Use a virtual path.


This is an example of a parent path:
Relative parent paths in include statements use the following form:
<!--#include file="../<filename.ext>"-->


This is an example of a virtual path:
The syntax example below illustrates how to implement virtual paths:
<!--#include virtual="/<virtual path>/<filename.ext>"-->

<!--#include file="../Index2/page_2.asp" -->

Error that will appear:


Active Server Pages error ’ASP 0131’
Disallowed Parent Path
/index/page_1.asp, line 11
The Include file ’../Index2/page_2.asp’ cannot contain ’..’ to indicate the parent directory.

You need to replace this line with:
<!--#include virtual="/Index2/page_2.asp"-->

0 (0)
Article Rating (No Votes)
Rate this article
There are no attachments for this article.
Related Articles
Which non-standard ASP components have been installed on the Hostbasket Shared ASP.Net Servers?
Viewed 3963 times since Mon, Nov 9, 2009
Which versions of the .NET framework are supported?
Viewed 3575 times since Tue, Sep 21, 2010
How to install dotnetnuke 09.02 on our webhosting ?
Viewed 1984 times since Tue, Oct 8, 2013
What is ASP.NET 4.7.1?
Viewed 4515 times since Tue, Nov 18, 2008
Which .NET Framework Trust levels are allowed?
Viewed 7935 times since Mon, Sep 12, 2016
How to set the .NET Framework Trust level yourself
Viewed 4128 times since Mon, Sep 12, 2016
How do I send e-mail from my windows webhosting package using ASP.NET code?
Viewed 3367 times since Tue, Nov 3, 2009
What is ASP/ASP.NET?
Viewed 3259 times since Thu, Nov 27, 2008
How do I recognize ASP/ASP.NET pages?
Viewed 2785 times since Tue, Nov 18, 2008