You are currently offline, waiting for your internet to reconnect

Your browser is out-of-date

You need to update your browser to use the site.

Update to the latest version of Internet Explorer

Enable Parent Paths Is Disabled by Default in IIS 6.0

This article was previously published under Q332117
SYMPTOMS
When you try to view an Active Server Pages (ASP) page that is running on Internet Information Services (IIS) 6.0, you may receive one of the following error messages in your browser:

If the Show Friendly Http Error Messages check box in Microsoft Internet Explorer is not selected:
Server.MapPath()error 'ASP 0175 : 80004005' Disallowed Path Characters
-or-
ASP error 0131 The include file <%filename.ext%> cannot contain '..' to indicate the parent directory. /<%path%>/<%filename.ext%>, line <%number%>
If the Show Friendly Http Error Messages check box in Microsoft Internet Explorer is selected:
The Page Cannot Be Displayed
HTTP 500-Internal server error
For additional information about disabling friendly HTTP error messages, click the following article number to view the article in the Microsoft Knowledge Base:
294807 HOW TO: Turn Off the Internet Explorer 5.x and 6.x "Show Friendly HTTP Error Messages" Feature on the Server Side
CAUSE
You receive this error message if the application calls an ASP method that requires the Parent Paths option to be enabled. The exact error message depends on the method that is being called.

By default, the Parent Paths option is enabled in IIS 5.0, but it is disabled by default in IIS 6.0.
STATUS
This behavior is by design.
MORE INFORMATION
The Parent Paths option (the AspEnableParentPaths metabase property) permits you to use ".." in calls to functions such as MapPath by allowing paths that are relative to the current directory using the ..\notation. Setting this property to True may constitute a security risk because an include path can access critical or confidential files outside the root directory of the application.

If your application contains a Web page that contains the #include server-side include directive and uses ".." notation to refer to a parent directory, you will experience this issue when the application is run on IIS 6.0 with the default setting.
WORKAROUND
To resolve this problem without changing the application:
  1. Click Start, click Administrative Tools, and then click Internet Information Services (IIS) Manager.
  2. Double-click your computer name in the left pane, and then double-click Web Sites.
  3. Locate the Web site and directory that houses the ASP application.
  4. Right-click the application site or directory, and then click Properties.
  5. Select Home Directory, and then click Configuration.
  6. Click Options, and then click to select the Enable Parent Paths check box.
  7. Click OK two times.
REFERENCES
For additional information about disabling Parent Paths on IIS 4.0 and IIS 5.0, click the following article number to view the article in the Microsoft Knowledge Base:
184717 AspEnableParentPaths MetaBase Property Should Be Set To False
For additional information about resolving this error in FrontPage 2000 applications, click the following article number to view the article in the Microsoft Knowledge Base:
276548 F000: ASP Error 0131 When You Browse to a Database Results Region
For more information about troubleshooting this and other ASP errors that may occur with IIS 6.0, visit the following Microsoft Web sites:
IIS 6 5 Enable Disable Parent Path Paths "Page Cannot Be Displayed" "ASP 0175" Quest Fastlane Activeroles
Properties

Article ID: 332117 - Last Review: 12/03/2007 21:25:30 - Revision: 4.7

  • Microsoft Internet Information Services 6.0
  • kbpending kbprb KB332117
Feedback