include file that is outside of web directory

Discussion in 'ASP General' started by Jonathan LaRosa, Aug 18, 2004.

  1. Hi all -

    I would like to do something like this:
    <!--#include file="C:\dbutils\dbConfig.asp"-->

    Where the directory C:\dbutils is OUTSIDE of the web directory and not
    accessible by a client web browser.

    The reason I would like to do this is in case somehow ASP processing
    gets turned off in IIS. Since "dbConfig.asp" contains a
    username/password for the database, I don't want this file to somehow
    get sent back to a client browser as plain text.

    Two questions:
    1) is it possible to use an include file that is outside of the web
    directory?
    2) is there even any way that ASP processing can be turned off?
    perhaps not explicitly, but maybe via malicious code or virus?

    thanks in advance,
    Jon LaRosa
    jlarosa at alumni dot brown dot edu
    Jonathan LaRosa, Aug 18, 2004
    #1
    1. Advertising

  2. > 1) is it possible to use an include file that is outside of the web
    > directory?


    Did you try what you posted?

    > 2) is there even any way that ASP processing can be turned off?
    > perhaps not explicitly, but maybe via malicious code or virus?


    Sure, anything is possible. However if a malicious user can get access to
    the filesystem in order to put and execute a virus, they could probably just
    open all the ASP files and find your usernames/passwords anyway.

    --
    http://www.aspfaq.com/
    (Reverse address to reply.)
    Aaron [SQL Server MVP], Aug 18, 2004
    #2
    1. Advertising

  3. Jonathan LaRosa

    Jon LaRosa Guest

    I did try it - I get a "Include file not found" error.

    When you write "Did you try what you posted?" are you saying this
    because it should work? Or are you saying this because you think it
    might work but you're not sure?

    thanks for you help.

    jon




    *** Sent via Developersdex http://www.developersdex.com ***
    Don't just participate in USENET...get rewarded for it!
    Jon LaRosa, Aug 18, 2004
    #3
  4. Jonathan LaRosa

    joker Guest

    To my knowledge you can not access an include file that is not hosted on
    the same server within the web shares.

    Jonathan LaRosa wrote:

    > Hi all -
    >
    > I would like to do something like this:
    > <!--#include file="C:\dbutils\dbConfig.asp"-->
    >
    > Where the directory C:\dbutils is OUTSIDE of the web directory and not
    > accessible by a client web browser.
    >
    > The reason I would like to do this is in case somehow ASP processing
    > gets turned off in IIS. Since "dbConfig.asp" contains a
    > username/password for the database, I don't want this file to somehow
    > get sent back to a client browser as plain text.
    >
    > Two questions:
    > 1) is it possible to use an include file that is outside of the web
    > directory?
    > 2) is there even any way that ASP processing can be turned off?
    > perhaps not explicitly, but maybe via malicious code or virus?
    >
    > thanks in advance,
    > Jon LaRosa
    > jlarosa at alumni dot brown dot edu
    joker, Aug 18, 2004
    #4
  5. > I did try it - I get a "Include file not found" error.

    Perhaps it's a permissions issue. Does IUSR_<your_machine_name> have
    sufficient access to c:\DBUtils\ ?

    > When you write "Did you try what you posted?" are you saying this
    > because it should work?


    I asked this for two reasons:

    (a) I'm sure I've seen this work before (likely IIS 4.0), but on my current
    OS (which runs IIS 6.0), it doesn't seem to work.

    (b) it wasn't clear that you had tried it. Many people post things like
    "will this code work?" without bothering to try it. Usually, if the person
    *had* tried it, they will also include information about what happened when
    they tried it, without being prodded.

    --
    http://www.aspfaq.com/
    (Reverse address to reply.)
    Aaron [SQL Server MVP], Aug 18, 2004
    #5
  6. Jonathan LaRosa

    Ray at Guest

    "Aaron [SQL Server MVP]" <> wrote in message
    news:e%...

    >
    > (a) I'm sure I've seen this work before (likely IIS 4.0), but on my
    > current
    > OS (which runs IIS 6.0), it doesn't seem to work.


    Did you enable "Enable parent paths?" :]

    Ray at work
    Ray at, Aug 18, 2004
    #6
  7. Jonathan LaRosa

    Jon LaRosa Guest

    I completely forgot about the permissions on that directory, but
    unfortunately that was not it. I still get the "Include file not found
    error".

    Maybe IIS no longer allows it. Damn.

    thanks for everyone's responses.

    jon


    *** Sent via Developersdex http://www.developersdex.com ***
    Don't just participate in USENET...get rewarded for it!
    Jon LaRosa, Aug 18, 2004
    #7
  8. Jonathan LaRosa

    Jon LaRosa Guest

    I didn't think "enabling parent paths" would come into play, since I
    wasn't using "../" at all. And indeed, enabling parent paths still
    doesn't allow me to use:
    <!--#include file="C:\dbutils\dbConfig.asp"-->

    But interestingly enough enabling parent paths did allow me to use this:
    <!--#include file=../../../../dbutils/dbConfig.asp-->

    so the problem is more or less solved. Of course the latter is a little
    messy with all the "../" and I would prefer to use a reference that
    didn't depend on the location of the file that had the include statement
    in it (e.g. the former), but oh well.

    thanks much,
    jon


    *** Sent via Developersdex http://www.developersdex.com ***
    Don't just participate in USENET...get rewarded for it!
    Jon LaRosa, Aug 18, 2004
    #8
  9. Jonathan LaRosa

    Roland Hall Guest

    "Jon LaRosa" wrote in message news:...
    :I didn't think "enabling parent paths" would come into play, since I
    : wasn't using "../" at all. And indeed, enabling parent paths still
    : doesn't allow me to use:
    : <!--#include file="C:\dbutils\dbConfig.asp"-->
    :
    : But interestingly enough enabling parent paths did allow me to use this:
    : <!--#include file=../../../../dbutils/dbConfig.asp-->
    :
    : so the problem is more or less solved. Of course the latter is a little
    : messy with all the "../" and I would prefer to use a reference that
    : didn't depend on the location of the file that had the include statement
    : in it (e.g. the former), but oh well.

    or make a virtual root that points to c:\dbutils called /dbutils and then
    use:
    <!--#include virtual="/dbutils/dbconfig.asp"-->

    You'll need read and script permissions.

    HTH...

    --
    Roland Hall
    /* This information is distributed in the hope that it will be useful, but
    without any warranty; without even the implied warranty of merchantability
    or fitness for a particular purpose. */
    Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
    WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
    MSDN Library - http://msdn.microsoft.com/library/default.asp
    Roland Hall, Aug 19, 2004
    #9
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Brian Simmons
    Replies:
    11
    Views:
    652
    Brian Simmons
    Aug 31, 2007
  2. Andreas Bogenberger
    Replies:
    3
    Views:
    903
    Andreas Bogenberger
    Feb 22, 2008
  3. Fabrice

    include a file outside the Web path?

    Fabrice, Apr 9, 2005, in forum: ASP General
    Replies:
    0
    Views:
    118
    Fabrice
    Apr 9, 2005
  4. SteveT

    include file outside web site

    SteveT, Feb 16, 2007, in forum: ASP General
    Replies:
    13
    Views:
    256
    Anthony Jones
    Feb 18, 2007
  5. Krzysztof Poc

    outside type, outside function

    Krzysztof Poc, Feb 3, 2012, in forum: C++
    Replies:
    1
    Views:
    285
    Victor Bazarov
    Feb 7, 2012
Loading...

Share This Page