ASP Error 0126 include file not found, when using ".." in include file path

Discussion in 'ASP General' started by Eric, Jan 9, 2007.

  1. Eric

    Eric Guest

    Hello,

    I have some server side includes on a Classic asp page that look
    something like:

    <!-- #include virtual="/includes/file1.asp"-->
    <!-- #include virtual="/includes/file2.asp" -->
    <!-- #include virtual="/includes/file3.asp" -->
    <!-- #include virtual="/includes/file4.asp" -->
    <!-- #include virtual="/includes/file5.asp" -->
    <!-- #include virtual="/includes/file6.asp" -->
    <!-- #include virtual="/includes/file7.asp" -->
    <!-- #include virtual="../includes/file8.asp" -->
    <!-- include virtual="/_utils/file9.asp" -->

    When we'd attempt to load the page it would give us a ASP Error 0126
    include file not found error referring to ../includes/file8.asp.

    I changed it to a /includes/file8.asp and the problem went away. I
    don't really see what the advantage of having the .. in there, but we
    have this type of syntax in a lot of other asp pages.

    I can do a search and replace, but I'm wondering if there's some IIS
    setting that will prevent the error from happening. I was thinking
    that we should turn on directory browsing, but it was already on (this
    is an internal test web site).

    Could there be some kind of user permission issue? This is on a
    freshly built from scratch test server. The web page hasn't really
    changed much, not at all with regard to this include statement.

    Thanks,
    Eric
     
    Eric, Jan 9, 2007
    #1
    1. Advertising

  2. Eric

    Evertjan. Guest

    Eric wrote on 09 jan 2007 in microsoft.public.inetserver.asp.general:

    > <!-- #include virtual="../includes/file8.asp" -->
    >


    IMHO:

    virtual including starts from the web root,
    so ../ would go below the root, which should be impossible,
    given the normal settings of IIS.

    I heard that IIS6 was more strict in this in it's default settings.

    Second:
    Is this directory permitted to be accessed by the ASP default user?

    --
    Evertjan.
    The Netherlands.
    (Please change the x'es to dots in my emailaddress)
     
    Evertjan., Jan 9, 2007
    #2
    1. Advertising

  3. "Eric" <> wrote in message
    news:...
    > Hello,
    >
    > I have some server side includes on a Classic asp page that look
    > something like:
    >
    > <!-- #include virtual="/includes/file1.asp"-->
    > <!-- #include virtual="/includes/file2.asp" -->
    > <!-- #include virtual="/includes/file3.asp" -->
    > <!-- #include virtual="/includes/file4.asp" -->
    > <!-- #include virtual="/includes/file5.asp" -->
    > <!-- #include virtual="/includes/file6.asp" -->
    > <!-- #include virtual="/includes/file7.asp" -->
    > <!-- #include virtual="../includes/file8.asp" -->
    > <!-- include virtual="/_utils/file9.asp" -->
    >
    > When we'd attempt to load the page it would give us a ASP Error 0126
    > include file not found error referring to ../includes/file8.asp.
    >
    > I changed it to a /includes/file8.asp and the problem went away. I
    > don't really see what the advantage of having the .. in there, but we
    > have this type of syntax in a lot of other asp pages.
    >
    > I can do a search and replace, but I'm wondering if there's some IIS
    > setting that will prevent the error from happening. I was thinking
    > that we should turn on directory browsing, but it was already on (this
    > is an internal test web site).
    >
    > Could there be some kind of user permission issue? This is on a
    > freshly built from scratch test server. The web page hasn't really
    > changed much, not at all with regard to this include statement.
    >


    IIS 6?

    By default parent paths are disabled. You can open the application
    properties on home directory tab click click configuration. On the App
    Options of the configuration dialog enable parent paths.

    However for security reason you would be better of modifying your pages to
    use an absolute path in this instance.


    > Thanks,
    > Eric
    >
     
    Anthony Jones, Jan 9, 2007
    #3
  4. Eric

    Eric Guest

    Anthony Jones wrote:
    > "Eric" <> wrote in message
    > news:...
    > > Hello,
    > >
    > > I have some server side includes on a Classic asp page that look
    > > something like:
    > >
    > > <!-- #include virtual="/includes/file1.asp"-->
    > > <!-- #include virtual="/includes/file2.asp" -->
    > > <!-- #include virtual="/includes/file3.asp" -->
    > > <!-- #include virtual="/includes/file4.asp" -->
    > > <!-- #include virtual="/includes/file5.asp" -->
    > > <!-- #include virtual="/includes/file6.asp" -->
    > > <!-- #include virtual="/includes/file7.asp" -->
    > > <!-- #include virtual="../includes/file8.asp" -->
    > > <!-- include virtual="/_utils/file9.asp" -->
    > >
    > > When we'd attempt to load the page it would give us a ASP Error 0126
    > > include file not found error referring to ../includes/file8.asp.
    > >
    > > I changed it to a /includes/file8.asp and the problem went away. I
    > > don't really see what the advantage of having the .. in there, but we
    > > have this type of syntax in a lot of other asp pages.
    > >
    > > I can do a search and replace, but I'm wondering if there's some IIS
    > > setting that will prevent the error from happening. I was thinking
    > > that we should turn on directory browsing, but it was already on (this
    > > is an internal test web site).
    > >
    > > Could there be some kind of user permission issue? This is on a
    > > freshly built from scratch test server. The web page hasn't really
    > > changed much, not at all with regard to this include statement.
    > >

    >
    > IIS 6?
    >
    > By default parent paths are disabled. You can open the application
    > properties on home directory tab click click configuration. On the App
    > Options of the configuration dialog enable parent paths.
    >
    > However for security reason you would be better of modifying your pages to
    > use an absolute path in this instance.
    >
    >


    Well I changed the .. on the server side includes to use an absolute
    path and it fixed it. I did a some further investigation and it turned
    out this was only done in 5 places in the app. However, we DID have
    parent paths enabled. I wrote earlier that we had directory browsing
    turned on, when I meant parent paths. We do this because we use parent
    paths elsewhere in our application.

    The web page that was calling the server side include with the ".."
    wasn't in the root directory, so this should have been valid, in
    theory.

    Like I said, I can't see any good reason to use the parent paths in
    this case. It would be great if someone could point me at some MS
    documentation where they spell out what setting would make it possible
    for this to with IIS 6, or at least confirming that they don't allow
    this any longer.

    Thanks,
    Eric
     
    Eric, Jan 10, 2007
    #4
  5. Eric wrote:
    >
    > Like I said, I can't see any good reason to use the parent paths in
    > this case. It would be great if someone could point me at some MS
    > documentation where they spell out what setting would make it possible
    > for this to with IIS 6, or at least confirming that they don't allow
    > this any longer.
    >

    Parent paths work fine on our IIS6 server after enabling them.

    --
    Microsoft MVP -- ASP/ASP.NET
    Please reply to the newsgroup. The email account listed in my From
    header is my spam trap, so I don't check it very often. You will get a
    quicker response by posting to the newsgroup.
     
    Bob Barrows [MVP], Jan 10, 2007
    #5
  6. Eric

    Eric Guest

    Bob Barrows [MVP] wrote:
    > Eric wrote:
    > >
    > > Like I said, I can't see any good reason to use the parent paths in
    > > this case. It would be great if someone could point me at some MS
    > > documentation where they spell out what setting would make it possible
    > > for this to with IIS 6, or at least confirming that they don't allow
    > > this any longer.
    > >

    > Parent paths work fine on our IIS6 server after enabling them.
    >


    On server side includes too?
     
    Eric, Jan 10, 2007
    #6
  7. Eric

    Mike Brind Guest

    "Eric" <> wrote in message
    news:...
    >
    > Bob Barrows [MVP] wrote:
    >> Eric wrote:
    >> >
    >> > Like I said, I can't see any good reason to use the parent paths in
    >> > this case. It would be great if someone could point me at some MS
    >> > documentation where they spell out what setting would make it possible
    >> > for this to with IIS 6, or at least confirming that they don't allow
    >> > this any longer.
    >> >

    >> Parent paths work fine on our IIS6 server after enabling them.
    >>

    >
    > On server side includes too?
    >


    The parent-paths issue is only relevant to the server-side.

    -
    Mike Brind
     
    Mike Brind, Jan 10, 2007
    #7
  8. Mike Brind wrote:
    >>> Parent paths work fine on our IIS6 server after enabling them.

    >>
    >> On server side includes too?

    >
    > The parent-paths issue is only relevant to the server-side.


    Just a casual observation and a resulting question here. The term "include"
    does seem the point of the question, not "server-side". So I am wondering --
    are the things affected other than includes when parent paths are enabled?
    Among the things that come to mind are Server.Execute() or Server.Transfer()
    calls and paths to such things as .mdb files -- or the file system in
    general.

    Anyone know? I cannot find anything on MSDN but this:
    http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
    specify what is limited by a "path".



    --
    Dave Anderson

    Unsolicited commercial email will be read at a cost of $500 per message. Use
    of this email address implies consent to these terms.
     
    Dave Anderson, Jan 10, 2007
    #8
  9. Eric

    Eric Guest

    Mike Brind wrote:
    > "Eric" <> wrote in message
    > news:...
    > >
    > > Bob Barrows [MVP] wrote:
    > >> Eric wrote:
    > >> >
    > >> > Like I said, I can't see any good reason to use the parent paths in
    > >> > this case. It would be great if someone could point me at some MS
    > >> > documentation where they spell out what setting would make it possible
    > >> > for this to with IIS 6, or at least confirming that they don't allow
    > >> > this any longer.
    > >> >
    > >> Parent paths work fine on our IIS6 server after enabling them.
    > >>

    > >
    > > On server side includes too?
    > >

    >
    > The parent-paths issue is only relevant to the server-side.
    >
    > -
    > Mike Brind


    Actually it wasn't the server side includes we were having problems
    with, it was the virtual server side includes.

    -Eric
     
    Eric, Jan 10, 2007
    #9
  10. Eric wrote:
    > Actually it wasn't the server side includes we were having problems
    > with, it was the virtual server side includes.


    I don't think you can use .. in virtual="" paths. I don't remember that ever
    being allowed.



    --
    Dave Anderson

    Unsolicited commercial email will be read at a cost of $500 per message. Use
    of this email address implies consent to these terms.
     
    Dave Anderson, Jan 10, 2007
    #10
  11. Eric

    Mike Guest

    "Dave Anderson" <> wrote in message
    news:%23$...
    > Mike Brind wrote:
    >>>> Parent paths work fine on our IIS6 server after enabling them.
    >>>
    >>> On server side includes too?

    >>
    >> The parent-paths issue is only relevant to the server-side.

    >
    > Just a casual observation and a resulting question here. The term
    > "include" does seem the point of the question, not "server-side". So I am
    > wondering -- are the things affected other than includes when parent
    > paths are enabled? Among the things that come to mind are Server.Execute()
    > or Server.Transfer() calls and paths to such things as .mdb files -- or
    > the file system in general.
    >
    > Anyone know? I cannot find anything on MSDN but this:
    > http://msdn2.microsoft.com/en-us/library/ms524697.aspx, which does not
    > specify what is limited by a "path".
    >
    >


    Mappath is affected. It seems that Server.Execute and Server.Transfer makke
    implicit use of Server.Mappath to resolve the file path, so they are
    affected too. If you try Server.Execute("../somefile.asp") when parent
    paths are disabled, the error message is "The '..' characters are not
    allowed in the Path parameter for the MapPath method."

    --
    Mike Brind
     
    Mike, Jan 11, 2007
    #11
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Guest

    HELP WITH ASP 0126 error

    Guest, Dec 18, 2003, in forum: ASP General
    Replies:
    2
    Views:
    294
    Jason M. Murray
    Dec 21, 2003
  2. masonj

    asp error 0126

    masonj, Jan 9, 2004, in forum: ASP General
    Replies:
    3
    Views:
    221
    Mason Myers
    Jan 9, 2004
  3. Mason Myers

    asp error 0126

    Mason Myers, Jan 9, 2004, in forum: ASP General
    Replies:
    4
    Views:
    230
    Roland Hall
    Jan 9, 2004
  4. Eric
    Replies:
    0
    Views:
    268
  5. Replies:
    5
    Views:
    321
Loading...

Share This Page