Does the Web Console require that the IIS parent path be enabled? (NETIQKB48180)

  • 7748180
  • 02-Feb-2007
  • 28-Jul-2010

Environment

AppManager Suite 6.x
AppManager Suite 7.0.x

Situation

Does the Web Console require that the IIS parent path be enabled?
Do I have to allow the use of relative paths to use the Web Console?
Can I prevent IIS from using ..\ without causing problem with the Web Console?

Resolution

The AppManager Web Console requires you to enable the IIS parent path option in the ISAPI Filter tab of IIS Default Web Site.

The Parent Paths option, which is the AspEnableParentPaths metabase property, allows use of ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the ..\notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application.

The AppManager Web Console contains the #include server-side include directive and uses ".." notation to refer to a parent directory.

For more information about the IIS Parent Path requirement, see the Microsoft QNote Article Q332117 at http://support.microsoft.com/kb/332117.



Additional Information

Formerly known as NETIQKB48180