Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP General > include file that is outside of web directory

Reply
Thread Tools

include file that is outside of web directory

 
 
Jonathan LaRosa
Guest
Posts: n/a
 
      08-18-2004
Hi all -

I would like to do something like this:
<!--#include file="C:\dbutils\dbConfig.asp"-->

Where the directory C:\dbutils is OUTSIDE of the web directory and not
accessible by a client web browser.

The reason I would like to do this is in case somehow ASP processing
gets turned off in IIS. Since "dbConfig.asp" contains a
username/password for the database, I don't want this file to somehow
get sent back to a client browser as plain text.

Two questions:
1) is it possible to use an include file that is outside of the web
directory?
2) is there even any way that ASP processing can be turned off?
perhaps not explicitly, but maybe via malicious code or virus?

thanks in advance,
Jon LaRosa
jlarosa at alumni dot brown dot edu
 
Reply With Quote
 
 
 
 
Aaron [SQL Server MVP]
Guest
Posts: n/a
 
      08-18-2004
> 1) is it possible to use an include file that is outside of the web
> directory?


Did you try what you posted?

> 2) is there even any way that ASP processing can be turned off?
> perhaps not explicitly, but maybe via malicious code or virus?


Sure, anything is possible. However if a malicious user can get access to
the filesystem in order to put and execute a virus, they could probably just
open all the ASP files and find your usernames/passwords anyway.

--
http://www.aspfaq.com/
(Reverse address to reply.)


 
Reply With Quote
 
 
 
 
Jon LaRosa
Guest
Posts: n/a
 
      08-18-2004
I did try it - I get a "Include file not found" error.

When you write "Did you try what you posted?" are you saying this
because it should work? Or are you saying this because you think it
might work but you're not sure?

thanks for you help.

jon




*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!
 
Reply With Quote
 
joker
Guest
Posts: n/a
 
      08-18-2004
To my knowledge you can not access an include file that is not hosted on
the same server within the web shares.

Jonathan LaRosa wrote:

> Hi all -
>
> I would like to do something like this:
> <!--#include file="C:\dbutils\dbConfig.asp"-->
>
> Where the directory C:\dbutils is OUTSIDE of the web directory and not
> accessible by a client web browser.
>
> The reason I would like to do this is in case somehow ASP processing
> gets turned off in IIS. Since "dbConfig.asp" contains a
> username/password for the database, I don't want this file to somehow
> get sent back to a client browser as plain text.
>
> Two questions:
> 1) is it possible to use an include file that is outside of the web
> directory?
> 2) is there even any way that ASP processing can be turned off?
> perhaps not explicitly, but maybe via malicious code or virus?
>
> thanks in advance,
> Jon LaRosa
> jlarosa at alumni dot brown dot edu


 
Reply With Quote
 
Aaron [SQL Server MVP]
Guest
Posts: n/a
 
      08-18-2004
> I did try it - I get a "Include file not found" error.

Perhaps it's a permissions issue. Does IUSR_<your_machine_name> have
sufficient access to c:\DBUtils\ ?

> When you write "Did you try what you posted?" are you saying this
> because it should work?


I asked this for two reasons:

(a) I'm sure I've seen this work before (likely IIS 4.0), but on my current
OS (which runs IIS 6.0), it doesn't seem to work.

(b) it wasn't clear that you had tried it. Many people post things like
"will this code work?" without bothering to try it. Usually, if the person
*had* tried it, they will also include information about what happened when
they tried it, without being prodded.

--
http://www.aspfaq.com/
(Reverse address to reply.)


 
Reply With Quote
 
Ray at
Guest
Posts: n/a
 
      08-18-2004

"Aaron [SQL Server MVP]" <(E-Mail Removed)> wrote in message
news:e%(E-Mail Removed)...

>
> (a) I'm sure I've seen this work before (likely IIS 4.0), but on my
> current
> OS (which runs IIS 6.0), it doesn't seem to work.


Did you enable "Enable parent paths?" :]

Ray at work


 
Reply With Quote
 
Jon LaRosa
Guest
Posts: n/a
 
      08-18-2004
I completely forgot about the permissions on that directory, but
unfortunately that was not it. I still get the "Include file not found
error".

Maybe IIS no longer allows it. Damn.

thanks for everyone's responses.

jon


*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!
 
Reply With Quote
 
Jon LaRosa
Guest
Posts: n/a
 
      08-18-2004
I didn't think "enabling parent paths" would come into play, since I
wasn't using "../" at all. And indeed, enabling parent paths still
doesn't allow me to use:
<!--#include file="C:\dbutils\dbConfig.asp"-->

But interestingly enough enabling parent paths did allow me to use this:
<!--#include file=../../../../dbutils/dbConfig.asp-->

so the problem is more or less solved. Of course the latter is a little
messy with all the "../" and I would prefer to use a reference that
didn't depend on the location of the file that had the include statement
in it (e.g. the former), but oh well.

thanks much,
jon


*** Sent via Developersdex http://www.developersdex.com ***
Don't just participate in USENET...get rewarded for it!
 
Reply With Quote
 
Roland Hall
Guest
Posts: n/a
 
      08-19-2004
"Jon LaRosa" wrote in message news:(E-Mail Removed)...
:I didn't think "enabling parent paths" would come into play, since I
: wasn't using "../" at all. And indeed, enabling parent paths still
: doesn't allow me to use:
: <!--#include file="C:\dbutils\dbConfig.asp"-->
:
: But interestingly enough enabling parent paths did allow me to use this:
: <!--#include file=../../../../dbutils/dbConfig.asp-->
:
: so the problem is more or less solved. Of course the latter is a little
: messy with all the "../" and I would prefer to use a reference that
: didn't depend on the location of the file that had the include statement
: in it (e.g. the former), but oh well.

or make a virtual root that points to c:\dbutils called /dbutils and then
use:
<!--#include virtual="/dbutils/dbconfig.asp"-->

You'll need read and script permissions.

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
problem in running a basic code in python 3.3.0 that includes HTML file Satabdi Mukherjee Python 1 04-04-2013 07:48 PM
/* #include <someyhing.h> */ => include it or do not include it?That is the question .... Andreas Bogenberger C Programming 3 02-22-2008 10:53 AM
help with pix inside->outside + dmz->outside + inside->outside->dmz Jack Cisco 0 09-19-2007 01:57 AM
include file outside web site SteveT ASP General 13 02-18-2007 08:54 AM
include a file outside the Web path? Fabrice ASP General 0 04-09-2005 07:22 AM



Advertisments