ASP Error 0126 include file not found, when using ".." in include file path

[Eric]

Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

Thanks,
Eric

[Evertjan.]

Eric wrote on 09 jan 2007 in microsoft.public.inetserver.asp.general:

<!-- #include virtual="../includes/file8.asp" -->

IMHO:

virtual including starts from the web root,
so ../ would go below the root, which should be impossible,
given the normal settings of IIS.

I heard that IIS6 was more strict in this in it's default settings.

Second:
Is this directory permitted to be accessed by the ASP default user?

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Anthony Jones]

"Eric" <er**********@gmail.comwrote in message
news:11*********************@i56g2000hsf.googlegro ups.com...

Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.

Thanks,
Eric

[Eric]

Anthony Jones wrote:

"Eric" <er**********@gmail.comwrote in message
news:11*********************@i56g2000hsf.googlegro ups.com...

Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.

Well I changed the .. on the server side includes to use an absolute
path and it fixed it. I did a some further investigation and it turned
out this was only done in 5 places in the app. However, we DID have
parent paths enabled. I wrote earlier that we had directory browsing
turned on, when I meant parent paths. We do this because we use parent
paths elsewhere in our application.

The web page that was calling the server side include with the ".."
wasn't in the root directory, so this should have been valid, in
theory.

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Thanks,
Eric

[Bob Barrows [MVP]]

Eric wrote:

>
Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Parent paths work fine on our IIS6 server after enabling them.

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

[Eric]

Bob Barrows [MVP] wrote:

Eric wrote:

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

[Mike Brind]

"Eric" <er**********@gmail.comwrote in message
news:11**********************@77g2000hsv.googlegro ups.com...

>
Bob Barrows [MVP] wrote:

>Eric wrote:

>
Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.

-
Mike Brind

[Dave Anderson]

Mike Brind wrote:

>>Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.

Just a casual observation and a resulting question here. The term "include"
does seem the point of the question, not "server-side". So I am wondering --
are the things affected other than includes when parent paths are enabled?
Among the things that come to mind are Server.Execute() or Server.Transfer()
calls and paths to such things as .mdb files -- or the file system in
general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Eric]

Mike Brind wrote:

"Eric" <er**********@gmail.comwrote in message
news:11**********************@77g2000hsv.googlegro ups.com...

Bob Barrows [MVP] wrote:

Eric wrote:

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.

-
Mike Brind

Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.

-Eric

[Dave Anderson]

Eric wrote:

Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.

I don't think you can use .. in virtual="" paths. I don't remember that ever
being allowed.

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[Mike]

"Dave Anderson" <NY**********@spammotel.comwrote in message
news:%2****************@TK2MSFTNGP03.phx.gbl...

Mike Brind wrote:

>>>Parent paths work fine on our IIS6 server after enabling them.

On server side includes too?

The parent-paths issue is only relevant to the server-side.

Just a casual observation and a resulting question here. The term
"include" does seem the point of the question, not "server-side". So I am
wondering -- are the things affected other than includes when parent
paths are enabled? Among the things that come to mind are Server.Execute()
or Server.Transfer() calls and paths to such things as .mdb files -- or
the file system in general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".

Mappath is affected. It seems that Server.Execute and Server.Transfer makke
implicit use of Server.Mappath to resolve the file path, so they are
affected too. If you try Server.Execute("../somefile.asp") when parent
paths are disabled, the error message is "The '..' characters are not
allowed in the Path parameter for the MapPath method."

--
Mike Brind