Server.MapPath() error 'ASP 0175 : 80004005' The '..' characters are not allowed in the Path parameter for the MapPath m

The '..' Characters Are Not Allowed In The Path Parameter For The MapPath Method

Posted July 20, 2006 at 3:49 PM

Tags: XStandard WYSIWYG

I am covering for someone on vacation was given the task of configuring XStandard on a client site. The web services were not working and when accessed directly, the error they throw is:

The '..' characters are not allowed in the Path parameter for the MapPath method

The client is running off of the ASP version of the web services, not my ColdFusion implementation (again, not my client). This doesn't apply to my ColdFusion version, but, since I do so much Xstandard work, I figure I would post up the reason this happens. It's all about security. If you can put ".." in your MapPath() method, then you can go outside of your web root and I guess that freaks some people out. XStandard PRO needs this though because it uploads files to dynamic paths. So, we must allow ".." characters otherwise, we would never know to where we were uploading.

To remedy this (as taken off of the Fog Creek Software site):

Open IIS Manager, right click and choose properties on your [SITE_NAME] virtual directory (or the website root if [SITE_NAME] is installed at the root.

Click the Home Directory or Virtual Directory tab and choose the 'Configuration' button on that tab.

Click the Options tab and make sure the "Enable parent paths" setting is enabled.

Now, when accessed directly, the web services say: "Status: Ready".