Solved

classic asp on iis 7.5 includes not working

Posted on 2013-06-24
20
735 Views
Last Modified: 2013-06-27
I'm setting up a new server windows 2008 RS iis 7.5.  includes are not working.  How do I enable this feature for the classic asp pages?
0
Comment
Question by:smitty62
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 5
  • 3
20 Comments
 
LVL 58

Expert Comment

by:Gary
ID: 39272816
0
 

Author Comment

by:smitty62
ID: 39272913
I went through and read it, then made sure that it was checked.  It was checked and showed it as installed, but the CLASSIC asp pages are defineately not working with

<!--#include file="filename.htm" -->

Is there a different code syntax with 7.5?  Just because it's installed doesn't actually mean that it is enable does it?
0
 
LVL 58

Expert Comment

by:Gary
ID: 39272936
If you are using a file ext other than .shtml then you may need to map them to the SSI handler
http://tech.mikeal.com/blog1.php/server-side-includes-for-html-in-iis7
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 

Author Comment

by:smitty62
ID: 39272951
The filter at work is prohibiting me from seeing the above link.  The includes for the classic asp pages would be .htm file extention.  If I need to map them to the SSI handler how do I do that?  Can you send me a different link or do a cut and paste since I do not have access to the above link.  Thanks.
0
 
LVL 58

Expert Comment

by:Gary
ID: 39272972
But what page is calling the SSI - is it an html file or asp? If its asp it should work by default, if html then

In features view go to Handler Mappings

Under actions select "Add Module Mapping"

Enter the following information:

Request Path: *.html
 Module: ServerSideIncludeModule
 Executable: blank
 Name: SSI-html
0
 

Author Comment

by:smitty62
ID: 39272986
In features I do not see Handler Mappings.
0
 
LVL 53

Accepted Solution

by:
Scott Fell,  EE MVE earned 500 total points
ID: 39273009
What is not working?  You may have an error something about parent paths.  Or maybe you have the error and don't know it because by default friendly errors are sent to the browser.  

Your include file can be anything.  .asp, .htm, .inc, .txt and can be any mix of html or asp/vb code.  I would get in the habit of just using .asp though.

For injection safety, parent paths are probably turned off.  This means you can can't start  your include file with dots like   ../../some_folder/myIncludeFile.asp.  Instead use the full path like /includes/some_folder?myIncludeFile.asp
0
 

Author Comment

by:smitty62
ID: 39273032
This is the error in the log...

2013-06-24 18:58:29 10.65.1.53 GET /home/AppsLinks.asp |42|ASP_0131|Disallowed_Parent_Path 80 - 10.65.167.228 Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.1;+WOW64;+Trident/4.0;+GTB7.4;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.2;+.NET4.0C;+.NET+CLR+1.1.4322;+.NET4.0E) 500 0 0 0

This is the include line...

<!--#include file="<%response.write(Application("root"))%>/includes/main_nav.asp" -->

The global is working for the other links in the head...

<link href="<%response.write(Application("root"))%>/css/reset.css" rel="stylesheet" type="text/css" />
<link href="<%response.write(Application("root"))%>/css/style_main.css" rel="stylesheet" type="text/css" />

so I don't think it's the global.asa file.  The page works if I remove the...

<!--#include file="<%response.write(Application("root"))%>/includes/main_nav.asp" -->
0
 

Author Comment

by:smitty62
ID: 39273065
Now this is working on the old windows 2003 iis 6.0 server, and the <%response.write(Application("root"))%> is working on links.  I also tried ../ but that didn't work either.  I leave at 4:30 CST. so I'll post a comment tommorrow if I don't hear back from you today.
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 39273132
Like I said, the error is showing up, "Disallowed_Parent_Path 80 "
0
 

Author Comment

by:smitty62
ID: 39274604
Yes, and how do I enable the parent path?
0
 

Author Comment

by:smitty62
ID: 39274621
Never mind, I found it in manager.  It appears to be working now.  Thanks
0
 

Author Comment

by:smitty62
ID: 39274640
You only mention that "Parent paths are PROBABLY turned off".  You should have said, "Check to see if the parent path is turned off".  I felt you last commit was a bit terse.
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 39275651
I am very sorry you feel that way.  

However, my suggestion was NOT to check if that feature was on or off, my suggestion was to CHANGE the way you are specifying your links.  I would strongly suggest you don't turn that feature on as it is a security risk.  You would be better off using absolute links.  

If you are using dreamweaver and this is causing a problem go to your site set up where you manage servers and under the Advanced options you will see a radio button for links relative to Document or Site Root.  "Document" is defaulted and you just need to change that to "Site Root"

In web development, there are many multiple ways to get to the same visual end and most of those are work arounds.  If you ever find yourself needing to do a work around (such as this), stop and figure out the *real* solution as work arounds are quick fix's leading to future problems.  And the parent path thing is one of those that now leaves you with a security hole.  See step 11 http://msdn.microsoft.com/en-us/library/ff648653.aspx

While you may not fully understand why, I did actually give you a correct "A" answer with this paragraph.

For injection safety, parent paths are probably turned off.  This means you can can't start  your include file with dots like   ../../some_folder/myIncludeFile.asp.  Instead use the full path like /includes/some_folder?myIncludeFile.asp

fyi, you can use  /mypath/myfile.asp or mypath/myfile.asp but you can't use ../myfile.asp
0
 

Author Comment

by:smitty62
ID: 39275787
I see what you mean.  I had never heard that before concerning the transversal attacks.  THANK YOU VERY MUCH for that good information.  Yes, I will make the necessary changes.  Thank you again for your help.
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 39275897
No problem.  I have been through the same learning curve and that is why I recognize the potential issue you have.  Now you will be able to help somebody else in the same situation.

Can I ask you to click the request attention link under your original question and change the grade of this answer from "B" to "A"?

Thank you!
0
 

Author Comment

by:smitty62
ID: 39275915
Yes, I will do that.  By the way the physical folder and files are on D:/ drive while the OS is on C:/ do you think that is adequate to stop transveral attacks?
0
 
LVL 53

Expert Comment

by:Scott Fell, EE MVE
ID: 39275984
I am not a network security expert.  That would be a good question to ask posted in the security or networking area and the webserver.
0
 

Author Comment

by:smitty62
ID: 39275994
Okay, thank you for you help and patience with me.
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is a guide to setting up a new WHM/cPanel Server to be used for web hosting accounts. It is intended for web hosting company administrators and dedicated server owners. For under $99 per month (considering normal rate of Big Data Cetnters like …
What You Need to Know when Searching for a Webhost Provider
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question