correct way to include Classic ASP files in IIS7?

[SilverNodashi]

Hi everyone,

Does anyone know what the correct way is of including a Classic ASP file on an IIS7 server?

I don't have an ASP developer at this stage, and the original developer who developed a Classic ASP website for a client, who's website we had to move to an IIS7 server has emigrated with no current contact details.

All the searched I found on the web basically suggested I enable "Parent Paths", but I guess if that feature was disabled by default in II6 for security reasons then we'd rather not enable it, right?


The File which is being called from the browser, that gives the error is in :

C:\Users\cPanel\john\public_html\website1.TLD\manager
http://website1.TLD/manager/


The error it produces is:

Active Server Pages error 'ASP 0131'

Disallowed Parent Path

/manager/validateaddcat.asp, line 1

The Include file '../genincs/validator.asp' cannot contain '..' to indicate the parent directory.

that file, "validator.asp" is in a folder called:

C:\Users\cPanel\john\public_html\website1.TLD\genincs



And this is the code in /manager/validateaddcat.asp :

<!--#include file="../genincs/validator.asp"-->

<script ID=clientEventHandlersVBS LANGUAGE=vbscript>
<!--

I tried changing the code to

<!--#include file="C:\Users\cPanel\john\public_html\website1.TLD\genincs\validator.asp"-->

but that didn't work either.




Can anyone give me some suggestions on this?

 

[quovadis]

Parent paths are disabled by default on iis7 - Open the IIS Manager and go to the ASP feature - select true next to enable parent paths.

 

[Frikkenator]

You can change your includes to virtuals, that should solve the problem.

Try changing:
<!--#include file="../genincs/validator.asp"-->

To:
<!--#include virtual="/genincs/validator.asp"-->

 

[guest2013-1]

Parent paths are disabled by default on iis7 - Open the IIS Manager and go to the ASP feature - select true next to enable parent paths.

DONT do this

You can change your includes to virtuals, that should solve the problem.

Try changing:
<!--#include file="../genincs/validator.asp"-->

To:
<!--#include virtual="/genincs/validator.asp"-->

DO this

Best Practice Classic ASP coding 101. Use virtual instead of file (hence why it's disabled in IIS7... and I'm pretty sure 6 as well, however I couldn't be bothered since I've always used virtual after keeping up with security papers)

 

[SilverNodashi]

Best Practice Classic ASP coding 101. Use virtual instead of file (hence why it's disabled in IIS7... and I'm pretty sure 6 as well, however I couldn't be bothered since I've always used virtual after keeping up with security papers)

Thanx. I should have said: The site was already using the "virtual" directive and I changed it to "file" instead as per some website suggestions.


If it may help: This is on an Enkompass Server (which doesn't get support from cPanel anymore) and this particular website is a "addon domain" on top of another domain.

i.e. the main domain, http://maindomain.TLD get's it's content from "C:\Users\cPanel\john\public_html" and the 2nd domain, http://anotherdomain.TLD get's it content from C:\Users\cPanel\john\public_html\website1.TLD.


I don't know if IIS treats it differently than Apache / Linux does, but none of the include practices used on a Linux server works here.