Classic ASP Parent Paths let developers use relative addresses that contain ".." in the paths to files or folders. For example, the following code excerpt illustrates an ASP page that maps a parent path:
<% Response.Write Server.MapPath("../example.asp") %
Classic ASP Parent Paths let developers use relative addresses that contain ".." in the paths to files or folders. For example, the following code excerpt illustrates an ASP page that maps a parent path:
<% Response.Write Server.MapPath("../example.asp") %>
In addition, the following code except illustrates an ASP page that references an included file in a folder that uses a parent path:
In several earlier versions of IIS, parent paths were enabled by default. In IIS 6.0 the default behavior changed to disable parent paths, and this was done for security and design reasons: by preventing the execution of parent paths, you are preventing the inclusion of content across security or application boundaries. By default, class ASP script error messages are not sent to the Web browser, and any attempts to use parent paths will return the following error message to a Web browser:
An error occurred on the server when processing the URL. Please contact the system administrator. If you are the system administrator, please click here to find out more about this error. (Note: The ASP script error message listed above may be customized. For more information, see the Classic ASP script errors are no longer shown in a Web browser by default topic.)
If you enable sending ASP script error messages and your classic ASP scripts attempt to map a path in a parent folder, you receive the following error message in your Web browser:
Server.MapPath() error 'ASP 0175 : 80004005' Disallowed Path Characters /test/example.asp, line 100 The '..' characters are not allowed in the Path parameter for the MapPath method.
When your classic ASP scripts attempt to include a page that uses parent paths in IIS, you receive the following error message in your Web browser:
Active Server Pages error 'ASP 0131' Disallowed Parent Path /test/example.asp, line 100 The Include file '../_fpclass/fpdblib.inc' cannot contain '..' to indicate the parent directory.
Working with User Access Control
You need to make sure that you follow the steps in this document by using an account that has full administrative permissions. This is best accomplished by using one of two methods:
- Log in to your computer by using the local administrator account.
- If you are logged in using an account that has administrative permissions but that is not the local administrator account, open all applications and all command prompt sessions by using the "Run as Administrator" option.
These above conditions are required because the User Account Control (UAC) security component in Windows Vista and Windows Server 2008 will prevent administ