470,602 Members | 1,496 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 470,602 developers. It's quick & easy.

ASP Error 0126 include file not found, when using ".." in include file path

Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

Thanks,
Eric

Jan 9 '07 #1
10 18110
Eric wrote on 09 jan 2007 in microsoft.public.inetserver.asp.general:
<!-- #include virtual="../includes/file8.asp" -->
IMHO:

virtual including starts from the web root,
so ../ would go below the root, which should be impossible,
given the normal settings of IIS.

I heard that IIS6 was more strict in this in it's default settings.

Second:
Is this directory permitted to be accessed by the ASP default user?

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)
Jan 9 '07 #2

"Eric" <er**********@gmail.comwrote in message
news:11*********************@i56g2000hsf.googlegro ups.com...
Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.
IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.

Thanks,
Eric

Jan 9 '07 #3

Anthony Jones wrote:
"Eric" <er**********@gmail.comwrote in message
news:11*********************@i56g2000hsf.googlegro ups.com...
Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.

Well I changed the .. on the server side includes to use an absolute
path and it fixed it. I did a some further investigation and it turned
out this was only done in 5 places in the app. However, we DID have
parent paths enabled. I wrote earlier that we had directory browsing
turned on, when I meant parent paths. We do this because we use parent
paths elsewhere in our application.

The web page that was calling the server side include with the ".."
wasn't in the root directory, so this should have been valid, in
theory.

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Thanks,
Eric

Jan 10 '07 #4
Eric wrote:
>
Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.
Parent paths work fine on our IIS6 server after enabling them.

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.
Jan 10 '07 #5

Bob Barrows [MVP] wrote:
Eric wrote:

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.
Parent paths work fine on our IIS6 server after enabling them.
On server side includes too?

Jan 10 '07 #6

"Eric" <er**********@gmail.comwrote in message
news:11**********************@77g2000hsv.googlegro ups.com...
>
Bob Barrows [MVP] wrote:
>Eric wrote:
>
Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.
Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?
The parent-paths issue is only relevant to the server-side.

-
Mike Brind
Jan 10 '07 #7
Mike Brind wrote:
>>Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.
Just a casual observation and a resulting question here. The term "include"
does seem the point of the question, not "server-side". So I am wondering --
are the things affected other than includes when parent paths are enabled?
Among the things that come to mind are Server.Execute() or Server.Transfer()
calls and paths to such things as .mdb files -- or the file system in
general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.
Jan 10 '07 #8

Mike Brind wrote:
"Eric" <er**********@gmail.comwrote in message
news:11**********************@77g2000hsv.googlegro ups.com...

Bob Barrows [MVP] wrote:
Eric wrote:

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Parent paths work fine on our IIS6 server after enabling them.
On server side includes too?

The parent-paths issue is only relevant to the server-side.

-
Mike Brind
Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.

-Eric

Jan 10 '07 #9
Eric wrote:
Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.
I don't think you can use .. in virtual="" paths. I don't remember that ever
being allowed.

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.
Jan 10 '07 #10

"Dave Anderson" <NY**********@spammotel.comwrote in message
news:%2****************@TK2MSFTNGP03.phx.gbl...
Mike Brind wrote:
>>>Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.

Just a casual observation and a resulting question here. The term
"include" does seem the point of the question, not "server-side". So I am
wondering -- are the things affected other than includes when parent
paths are enabled? Among the things that come to mind are Server.Execute()
or Server.Transfer() calls and paths to such things as .mdb files -- or
the file system in general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".

Mappath is affected. It seems that Server.Execute and Server.Transfer makke
implicit use of Server.Mappath to resolve the file path, so they are
affected too. If you try Server.Execute("../somefile.asp") when parent
paths are disabled, the error message is "The '..' characters are not
allowed in the Path parameter for the MapPath method."

--
Mike Brind
Jan 11 '07 #11

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

3 posts views Thread by masonj | last post: by
2 posts views Thread by akhilesh.noida | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.