Disabled Parents CodeUnit 23 OCT 2008

ASPIf you’ve ever tried to do an ASP include using the following sort of input line,
, on an IIS web server and you’ve come up short, the 500.100 error message you are most likely to receive will look something like this:

Active Server Pages error ‘ASP 0131’ (0x80004005)
Disallowed Parent Path
The Include file ‘../includefile.asp’ cannot contain ‘..’ to indicate the parent directory.

Similarly, any Server.MapPath calls looking like server.mappath(“../includefile.asp”) and running on the same server will also generate a 500.100 error, with the resultant error message looking like this:

Server.MapPath(), ASP 0175 (0x80004005)
The ‘..’ characters are not allowed in the Path parameter for the MapPath method.

This error indicates that your servers Parent Paths option is disabled, which believe it or not, is actually a very good thing! The reason for it being turned off is to prevent unauthorised scripts that may be injected into the server from accessing or ‘including’ critical or confidential resources outside of the current web directory.

The Parents Path (the AspEnableParentPaths metabase property) option IS usually already enabled in IIS5.0, but since IIS 6.0 it has been disabled by default.

To be honest, the best workaround for this error is to rewrite your code or restructure your folders in such a way that the “..” backwards notation is not required in the first place. However, if you really must allow for its use, then you can follow these steps to enable Parent Paths on your server:

1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. Double-click your computer name in the left pane, and then double-click Web Sites.
3. Locate the Web site and directory that houses the ASP application.
4. Right-click the application site or directory, and then click Properties.
5. Select Home Directory, and then click Configuration.
6. Click Options, and then click to select the Enable Parent Paths check box.
7. Click OK two times.

Related link: http://support.microsoft.com/kb/332117

Related Posts:

About Craig Lotter

South African software architect and developer at Touchwork. Husband to a cupcake baker and father to two little girls. I don't have time for myself any more.