Modify server.mappath to something else as shared hosting does not allow parent paths - asp-classic

I am using the following code to connect to my database. It worked perfectly until my host upgraded IIS and it now wont connect due to parent paths being disabled by default.
I have tried using the virtual path to the file instead and it just errors out every time, regardless of what I try - even after getting the full virtual path of the file directly from my hosting company.
I need to change the server.mappath part of my connection script to something which allows me to use the full filepath or url of the file, but done know where to start.
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" &
Server.MapPath("../stockdetails.mdb")
On most other pages its coded as follows:
filePath = Server.MapPath("../stockdetails.mdb")
objDataConn.Open("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" +filePath)
If I leave everything as it is, I get the following error:
The '..' characters are not allowed in the Path parameter for the MapPath method.
I created another file to output the full filepath of the database. This output the below:
\\e379583ad6.storage-1a.hosting.MYDOMAINNAME\sites\1a\e\e379583ad6\public_html\nurbek\stockdetails.mdb
With this information I changed the connection script to this:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" &
Server.MapPath("\e379583ad6.storage-1a.hosting.MYDOMAINNAME\sites\1a\e\e379583ad6\public_html\nurbek\stockdetails.mdb")
This then gave me the error message:
[Microsoft][ODBC Microsoft Access Driver] '(unknown)' is not a valid path. Make sure that the path name is spelled correctly and that you are connected to the server on which the file resides.
Can anyone suggest how I can modify these 2 connection scripts to use the full filepath instead?
www.mydomainname.com/nurbek/stockdetails.mdb

By default Parent Paths are disabled in IIS so most Shared Hosting Providers do not modify this. That being said you can modify it yourself using an IIS configuration file which is supported in IIS 7.0 and above.
The steps are fairly simple to implement;
Create a new file called web.config in the root of the website.
Add the configuration XML to set Parent Paths (the example below enables Parent Paths, Response buffering and Session state);
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<asp enableParentPaths="true" bufferingOn="true">
<session allowSessionState="true" />
</asp>
</system.webServer>
</configuration>
Save the file (should be encoded as UTF-8).
Now you should be able to run the website without requiring any modifications to the Server.MapPath() code.
Useful Links
Microsoft Docs - Configuration Reference - ASP <asp>

Server.MapPath is used to convert parent paths (or a virtual path) into an absolute path. If you try to pass an already absolute path to Server.MapPath you'll receive an "Invalid Path" error, as you've already established what the absolute path is.
Using Server.MapPath is preferable as it allows you to migrate your code without having to edit any absolute path addresses, but if you're unable to use it you can just reference the full absolute path instead. This should work:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" &_
"\\e379583ad6.storage-1a.hosting.MYDOMAINNAME\sites\1a\e\e379583ad6\public_html\nurbek\stockdetails.mdb;"

Related

Response.WriteFile adding directory path where it shouldnt

I have a web page that is displaying a PDF file with the following code:
Response.Clear();
strFilePath = Server.HtmlDecode(Request.QueryString["filename"]);
Response.ContentType = "application/pdf";
Response.WriteFile(strFilePath);
The filename got from Server.HtmlDecode() is "\FileServer\shared\faxqueue\fax.pdf"
However an exception is thrown for directory not found and it says that it cant find the file. It also says in the exception that it is looking for: "C:[Website Root Folder]\FileServer\shared\faxqueue\fax.pdf"
This means that it has appended the filename given to the folder where the website code is located.
How can I stop it from using the website root?
Thanks
That is true because you ask it to do so.
It is a bad idea to pass in the direct file name using the query parameters.
You can of course create a direct path to the file you are using instead of this relative path:
string absolutePath = Path.Combine(#"C:\yourRootFolder", strFilePath);
Response.WriteFile(absolutePath);
But as said, I warn you for the security risks! You have to grant the IIS application pool user access to the folder you specify here. Your files can be easily hijacked by passing in something like:
..\..\..\Windows\anysecurefile.txt

FileUpload control (UploadButton.PostedFile.FileName)

Recently i developed a code on asp that requires to upload a file up to a server.
As i found out from the web, in order to view the local file of a file it can be done by doing UploadButton.PostedFile.Filename.
string fileName = UploadButton.PostedFile.Filename;
This will show the whole local path(eg. C:\Documents and Settings\christopher.lim\Desktop\HelloWorld.txt).
This work fine if it is run the code on my desktop (where my PC is the server itself) but when i shifted the code over to a test server and tried it on my desktop(PC is the client), it only display my file name instead of the whole path.
Example:
string fileName = UploadButton.PostedFile.Filename;
Response.Write("FileName: " + fileName);
1) Local PC -> C:\Documents and Settings\christopher.lim\Desktop\HelloWorld.txt
2) Test Server -> HelloWorld.txt
P/S: Sorry if it's confusing because i am new to server client. Correct me if i'm wrong.
As per MSDN-
The file name that the FileName property returns does not include the
path of the file on the client.
While it is true that on a local system you can get the complete path, but while you run it on a server it will only return the name of the file.
Also FYI the file upload control behaves differently in different browsers. In firefox you ill probably get only the file name and not the full path using fileupload.postedfile.filename and in IE the same thing may show you the full path.
However the path of the file uploaded from client system shouldn't matter as only the file name is more than enough, but if you still have the need try- Path.GetFileName(filename) MSDN link

VBScript:FileSystemObject.Can i use GetFolder method with absolute url?

in ASP-vbscript, I can use the GetFolder method of FileSystemObject to get the contents inside a folder if i pass the location of the folder
Set fso = CreateObject("Scripting.FileSystemObject")
Set folder = fso.GetFolder(Server.MapPath("myfolder"))
Can i use the same method with a url instead of foldername
like
Set folder = fso.GetFolder("http://www.mysite.com/myfolder/")
When trying this i am getting error
Microsoft VBScript runtime error '800a004c'
Path not found
I manage the "mysite.com" site.So i can make any folder permissions if needed.
Any thoughts ?
No you cannot, the FileSystemObject is exclusively for managing files.
Within ASP you can use the Server.MapPath() method to get the physical path for a relative path or you can use Request.ServerVariables("APPL_PHYSICAL_PATH") to get the base physical path of your application and then use these paths with the FileSystemObject but it won't accept URLs
I may be wrong but it should however accept UNC paths so you should be able to connect to network drives to which your computer can connect.

ASP .NET invalid path

I have a web page which prompts the user for an excel file using the fileupload control. What it then does is read the file into a datatable using an OleDbConnection and then runs other code with that data. When I test in Visual Studio, it works fine. For example, I can look up a file 'g:\myfiles\upldtest.xls', it finds the file, reads it and the code works. When I try to run it on our web server, I get an error when it tries to create an OleDBConnection saying It is trying to create an OleDbConnection and the path 'g:\myfiles\upldtest.xls' is invalid.
I tried to use ManagementObjectSearcher to convert the connection string path to UNC (\\MyDataServer\myfiles instead of g:\myfiles). When I test it, it shows the correct path but when I upload the page to the web server, I still get the path 'g:\myfiles\upldtest.xls' is invalid.
The code I use to determine the required file name is this
string tname = FileUpload1.PostedFile.FileName; //the file name and path
string gname = tname.Substring(tname.LastIndexOf("\\") + 1); //The path name
Any ideas what I am missing? My contract requires me to use VS2005 and .NET framework 2.0 so, I can't use anything newer. Thanks in advance for the assistance.
HttpPostedFile.FileName returns the fully qualified name of the file on the client machine.
You need to call SaveAs() to actually save the file on the server:
using System.IO;
string filename = Path.GetFileName(FileUpload1.PostedFile.FileName);
string filepath = Path.Combine(#"X:\Your\Own\Upload\Folder", filename);
FileUpload1.PostedFile.SaveAs(filepath);
// Now use `filepath` as your data source.
IIS might have already written the file in a temporary location to save memory, but since you can't (and shouldn't) access that location, it makes no difference.
You should also be aware of cross-browser issues. IE sends the whole path to the server on file upload, while Firefox/Chrome do not.

How to download a file from a UNC mapped share via IIS and ASP

I am writing an ASP application that will serve files to clients through the browser. The files are located on a file server that is available from the machine IIS is running on via a UNC path (\server\some\path).
I want to use something like the code below to serve the file. Serving files that are local to the machine IIS is running on is working well with this method, my trouble is being able to serve files from the UNC mapped share:
//Set the appropriate ContentType.
Response.ContentType = "Application/pdf";
//Get the physical path to the file.
string FilePath = MapPath("acrobat.pdf");
//Write the file directly to the HTTP content output stream.
Response.WriteFile(FilePath);
Response.End();
My question is how I can specify a UNC path for the file name. Also, to access the file share I need to connect with a specific username/password.
I would appreciate some pointers on how I can achieve this (either using the approach above or by other means).
I'm not an ASP guy so I might be completely wrong with these answers.
Regarding the path, I don't think you should be using MapPath, since that's to get a relative path and you already know the physical path so can't you just change that to:
string FilePath = #"\\Server\Directory\FileName.txt";
Regarding the account, I think you need to use impersonation, this link seems to discuss just this:
http://aspalliance.com/336_Upload_Files_Using_ASPNET_Impersonation_and_UNC_Share.all

Resources