Back to Top
The nuts and bolts for
Creative web development

ASP error - Disallowed Parent Path

Question:


I have got a technical problem. Can you explain me the following
statement, please:

Active Server Pages error ''ASP 0131''

Disallowed Parent Path

/knowledgebase/admin/index.asp, line 1

The Include file ''../ScriptLibrary/incPureUpload.asp'' cannot contain ''..'' to
indicate the parent directory.

Answer:


The problem you described is related to configuration of your web server. In order to avoid this problem please do the following

1. Go to your IIS Manager
2. Right click your web site
3. Choose Properties >
4. Select Home Directory Tab
5. Click ‘Configuration’ button
6. Select App Options Tab
7. Check the Enable Parent Paths
8. Click OK and your new configuration will be saved.

This problem occures specially on new Windows 2003 Server systems as the default setting is not to use parent paths.

Note: Another simple solution is to put your upload script page in your site root. This way it won't need to use parent paths to the ScriptLibrary folder.

George Petrov

George PetrovGeorge Petrov is a renowned software writer and developer whose extensive skills brought numerous extensions, articles and knowledge to the DMXzone- the online community for professional Adobe Dreamweaver users. His expertise in countless languages and technologies gives inspiration and teach valuable lessons on his website – DMXzone.com which is most popular for its over high-quality Dreamweaver extensions and templates.

See All Postings From George Petrov >>

Share this Article

Comments

Security concerns forenabling parentpath

I'm trying to launch a new site on a "major" web hosting "shared" server. My pages are ALL .asp data driven thus the default DMX Include (Connection) file call renders an error on every page but the "index". The host suggested security concerns and my first search reference on google suggested the same ( Michael Howard and David LeBlanc Writing Secure Code) - that parentpaths should never be enabled. So how about a solution - I tried the absolute file path address (e.g. <!--#include file="http://www.sampleaddress.com/Connections/dbfile.asp" -->) but this did not work.
??

Thanks

Don't use parent paths in the first place!

While this solution works, it is questionable at best because it is a security risk. The reason parent paths are disabled by default in Windows 2003 is for this reason. Yes, the proposed solution works, but the real issue is whether or not you should use parent paths.

RE: Disallowed Parent Path

get the latest Pure ASP Upload 2.17 - there you can specify that you want absolute paths

Disallowed Parent Path

I'm having the same problem, but except that I do not control my IIS, it's my provider. Basically my provider has deliberatly disabled using parent path. I get the error, so in all my page I've changed all the ""../" to "/", the only error now comes fron the incPureUpload.asp, line 204. Any idea how I can go round this or even change the parent path from building up string "../" to building up "/" instead.

Any help will be greatly appreciated.