ASP Error 0126 include file not found, when using ".." in include file path

E

Eric

Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

Thanks,
Eric
 
E

Evertjan.

Eric wrote on 09 jan 2007 in microsoft.public.inetserver.asp.general:
<!-- #include virtual="../includes/file8.asp" -->

IMHO:

virtual including starts from the web root,
so ../ would go below the root, which should be impossible,
given the normal settings of IIS.

I heard that IIS6 was more strict in this in it's default settings.

Second:
Is this directory permitted to be accessed by the ASP default user?
 
A

Anthony Jones

Eric said:
Hello,

I have some server side includes on a Classic asp page that look
something like:

<!-- #include virtual="/includes/file1.asp"-->
<!-- #include virtual="/includes/file2.asp" -->
<!-- #include virtual="/includes/file3.asp" -->
<!-- #include virtual="/includes/file4.asp" -->
<!-- #include virtual="/includes/file5.asp" -->
<!-- #include virtual="/includes/file6.asp" -->
<!-- #include virtual="/includes/file7.asp" -->
<!-- #include virtual="../includes/file8.asp" -->
<!-- include virtual="/_utils/file9.asp" -->

When we'd attempt to load the page it would give us a ASP Error 0126
include file not found error referring to ../includes/file8.asp.

I changed it to a /includes/file8.asp and the problem went away. I
don't really see what the advantage of having the .. in there, but we
have this type of syntax in a lot of other asp pages.

I can do a search and replace, but I'm wondering if there's some IIS
setting that will prevent the error from happening. I was thinking
that we should turn on directory browsing, but it was already on (this
is an internal test web site).

Could there be some kind of user permission issue? This is on a
freshly built from scratch test server. The web page hasn't really
changed much, not at all with regard to this include statement.

IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.
 
E

Eric

Anthony said:
IIS 6?

By default parent paths are disabled. You can open the application
properties on home directory tab click click configuration. On the App
Options of the configuration dialog enable parent paths.

However for security reason you would be better of modifying your pages to
use an absolute path in this instance.

Well I changed the .. on the server side includes to use an absolute
path and it fixed it. I did a some further investigation and it turned
out this was only done in 5 places in the app. However, we DID have
parent paths enabled. I wrote earlier that we had directory browsing
turned on, when I meant parent paths. We do this because we use parent
paths elsewhere in our application.

The web page that was calling the server side include with the ".."
wasn't in the root directory, so this should have been valid, in
theory.

Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.

Thanks,
Eric
 
B

Bob Barrows [MVP]

Eric said:
Like I said, I can't see any good reason to use the parent paths in
this case. It would be great if someone could point me at some MS
documentation where they spell out what setting would make it possible
for this to with IIS 6, or at least confirming that they don't allow
this any longer.
Parent paths work fine on our IIS6 server after enabling them.
 
D

Dave Anderson

Mike said:
The parent-paths issue is only relevant to the server-side.

Just a casual observation and a resulting question here. The term "include"
does seem the point of the question, not "server-side". So I am wondering --
are the things affected other than includes when parent paths are enabled?
Among the things that come to mind are Server.Execute() or Server.Transfer()
calls and paths to such things as .mdb files -- or the file system in
general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".
 
E

Eric

Mike said:
The parent-paths issue is only relevant to the server-side.

-
Mike Brind

Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.

-Eric
 
D

Dave Anderson

Eric said:
Actually it wasn't the server side includes we were having problems
with, it was the virtual server side includes.

I don't think you can use .. in virtual="" paths. I don't remember that ever
being allowed.
 
M

Mike

Dave Anderson said:
Just a casual observation and a resulting question here. The term
"include" does seem the point of the question, not "server-side". So I am
wondering -- are the things affected other than includes when parent
paths are enabled? Among the things that come to mind are Server.Execute()
or Server.Transfer() calls and paths to such things as .mdb files -- or
the file system in general.

Anyone know? I cannot find anything on MSDN but this:
http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
specify what is limited by a "path".

Mappath is affected. It seems that Server.Execute and Server.Transfer makke
implicit use of Server.Mappath to resolve the file path, so they are
affected too. If you try Server.Execute("../somefile.asp") when parent
paths are disabled, the error message is "The '..' characters are not
allowed in the Path parameter for the MapPath method."
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

Forum statistics

Threads
473,731
Messages
2,569,432
Members
44,832
Latest member
GlennSmall

Latest Threads

Top