include file that is outside of web directory

[Jonathan LaRosa]

Hi all -

I would like to do something like this:
<!--#include file="C:\dbutils\dbConfig.asp"-->

Where the directory C:\dbutils is OUTSIDE of the web directory and not
accessible by a client web browser.

The reason I would like to do this is in case somehow ASP processing
gets turned off in IIS. Since "dbConfig.asp" contains a
username/password for the database, I don't want this file to somehow
get sent back to a client browser as plain text.

Two questions:
1) is it possible to use an include file that is outside of the web
directory?
2) is there even any way that ASP processing can be turned off?
perhaps not explicitly, but maybe via malicious code or virus?

thanks in advance,
Jon LaRosa
jlarosa at alumni dot brown dot edu

[Aaron [SQL Server MVP]]

> 1) is it possible to use an include file that is outside of the web

directory?
Did you try what you posted?
2) is there even any way that ASP processing can be turned off?
perhaps not explicitly, but maybe via malicious code or virus?

Sure, anything is possible. However if a malicious user can get access to
the filesystem in order to put and execute a virus, they could probably just
open all the ASP files and find your usernames/passwords anyway.

--
http://www.aspfaq.com/
(Reverse address to reply.)

[Jon LaRosa]

I did try it - I get a "Include file not found" error.

When you write "Did you try what you posted?" are you saying this
because it should work? Or are you saying this because you think it
might work but you're not sure?

thanks for you help.

jon


*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[joker]

To my knowledge you can not access an include file that is not hosted on
the same server within the web shares.

Jonathan LaRosa wrote:

Hi all -

I would like to do something like this:
<!--#include file="C:\dbutils\dbConfig.asp"-->

Where the directory C:\dbutils is OUTSIDE of the web directory and not
accessible by a client web browser.

The reason I would like to do this is in case somehow ASP processing
gets turned off in IIS. Since "dbConfig.asp" contains a
username/password for the database, I don't want this file to somehow
get sent back to a client browser as plain text.

Two questions:
1) is it possible to use an include file that is outside of the web
directory?
2) is there even any way that ASP processing can be turned off?
perhaps not explicitly, but maybe via malicious code or virus?

thanks in advance,
Jon LaRosa
jlarosa at alumni dot brown dot edu

[Aaron [SQL Server MVP]]

> I did try it - I get a "Include file not found" error.

Perhaps it's a permissions issue. Does IUSR_<your_machine_name> have
sufficient access to c:\DBUtils\ ?

When you write "Did you try what you posted?" are you saying this
because it should work?

I asked this for two reasons:

(a) I'm sure I've seen this work before (likely IIS 4.0), but on my current
OS (which runs IIS 6.0), it doesn't seem to work.

(b) it wasn't clear that you had tried it. Many people post things like
"will this code work?" without bothering to try it. Usually, if the person
*had* tried it, they will also include information about what happened when
they tried it, without being prodded.

--
http://www.aspfaq.com/
(Reverse address to reply.)

[Ray at]

"Aaron [SQL Server MVP]" <te*****@dnartreb.noraa> wrote in message
news:e%****************@TK2MSFTNGP09.phx.gbl...

(a) I'm sure I've seen this work before (likely IIS 4.0), but on my
current
OS (which runs IIS 6.0), it doesn't seem to work.

Did you enable "Enable parent paths?" :]

Ray at work

[Jon LaRosa]

I completely forgot about the permissions on that directory, but
unfortunately that was not it. I still get the "Include file not found
error".

Maybe IIS no longer allows it. Damn.

thanks for everyone's responses.

jon
*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[Jon LaRosa]

I didn't think "enabling parent paths" would come into play, since I
wasn't using "../" at all. And indeed, enabling parent paths still
doesn't allow me to use:
<!--#include file="C:\dbutils\dbConfig.asp"-->

But interestingly enough enabling parent paths did allow me to use this:
<!--#include file=../../../../dbutils/dbConfig.asp-->

so the problem is more or less solved. Of course the latter is a little
messy with all the "../" and I would prefer to use a reference that
didn't depend on the location of the file that had the include statement
in it (e.g. the former), but oh well.

thanks much,
jon
*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!

[Roland Hall]

"Jon LaRosa" wrote in message news:OH**************@TK2MSFTNGP12.phx.gbl...
:I didn't think "enabling parent paths" would come into play, since I
: wasn't using "../" at all. And indeed, enabling parent paths still
: doesn't allow me to use:
: <!--#include file="C:\dbutils\dbConfig.asp"-->
:
: But interestingly enough enabling parent paths did allow me to use this:
: <!--#include file=../../../../dbutils/dbConfig.asp-->
:
: so the problem is more or less solved. Of course the latter is a little
: messy with all the "../" and I would prefer to use a reference that
: didn't depend on the location of the file that had the include statement
: in it (e.g. the former), but oh well.

or make a virtual root that points to c:\dbutils called /dbutils and then
use:
<!--#include virtual="/dbutils/dbconfig.asp"-->

You'll need read and script permissions.

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp