ASP error - Disallowed Parent Path

Question:

I have got a technical problem. Can you explain me the following
statement, please:

Active Server Pages error ''ASP 0131''

Disallowed Parent Path

/knowledgebase/admin/index.asp, line 1

The Include file ''../ScriptLibrary/incPureUpload.asp'' cannot contain ''..'' to
indicate the parent directory.

Answer:

The problem you described is related to configuration of your web server. In order to avoid this problem please do the following

1. Go to your IIS Manager
2. Right click your web site
3. Choose Properties >
4. Select Home Directory Tab
5. Click ‘Configuration’ button
6. Select App Options Tab
7. Check the Enable Parent Paths
8. Click OK and your new configuration will be saved.

This problem occures specially on new Windows 2003 Server systems as the default setting is not to use parent paths.

Note: Another simple solution is to put your upload script page in your site root. This way it won't need to use parent paths to the ScriptLibrary folder.

Comments

Disallowed Parent Path

January 18, 2004 by fidelis semper

I'm having the same problem, but except that I do not control my IIS, it's my provider. Basically my provider has deliberatly disabled using parent path. I get the error, so in all my page I've changed all the ""../" to "/", the only error now comes fron the incPureUpload.asp, line 204. Any idea how I can go round this or even change the parent path from building up string "../" to building up "/" instead.

Any help will be greatly appreciated.

RE: Disallowed Parent Path

January 21, 2004 by George Petrov

get the latest Pure ASP Upload 2.17 - there you can specify that you want absolute paths

Don't use parent paths in the first place!

June 22, 2004 by Ken Schiff

While this solution works, it is questionable at best because it is a security risk. The reason parent paths are disabled by default in Windows 2003 is for this reason. Yes, the proposed solution works, but the real issue is whether or not you should use parent paths.

Security concerns forenabling parentpath

June 28, 2004 by John Gough

I'm trying to launch a new site on a "major" web hosting "shared" server. My pages are ALL .asp data driven thus the default DMX Include (Connection) file call renders an error on every page but the "index". The host suggested security concerns and my first search reference on google suggested the same ( Michael Howard and David LeBlanc Writing Secure Code) - that parentpaths should never be enabled. So how about a solution - I tried the absolute file path address (e.g. ) but this did not work.
??

Thanks

You must me logged in to write a comment.