Re: .exe uplpoads
From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 05/22/04
- Next message: anonymous_at_discussions.microsoft.com: "Server Application Error"
- Previous message: David Wang [Msft]: "Re: Simmulation of form-data posting on one computer?"
- In reply to: anonymous: "Re: .exe uplpoads"
- Messages sorted by: [ date ] [ thread ]
Date: Sat, 22 May 2004 04:55:21 -0700
That is impossible to do in a correct fashion. Given an arbitrary
URL/Request, it is impossible for anything on the Web Server to determine
whether it is an upload or not, thus it is not possible to stop web editors
from placing whatever files they want, once they have write permissions. If
fact, someone can simply upload a .htm and rename it to .exe -- so what you
are doing is not useful.
Honestly, allowing upload of .EXE is no biggie. All you need to make sure
is that same directory does not end up with "Scripts and Executables"
execution permission -- without this setting, a .EXE is treated no different
than a .HTM by IIS.
-- //David IIS This posting is provided "AS IS" with no warranties, and confers no rights. // "anonymous" <anonymous@discussions.microsoft.com> wrote in message news:fe5901c43eb3$53a7a3e0$a301280a@phx.gbl... Thanks. I already use the URLScan utility (which is working fine)...was actually looking for a way to stop web editors from placing .exe files within their subwebs all together. >-----Original Message----- >You can use URLScan to disallow .EXE from being accepted by the server on >the URL (which disallows both requesting EXEs as well as uploading EXEs). >Otherwise, there is no generic feature for any web server to disallow the >upload of one file extension but not another. HTTP does not define an >"upload", and custom web server extension can implement "upload" in >arbitrary manners. > >-- >//David >IIS >This posting is provided "AS IS" with no warranties, and confers no rights. >// >"anonymous" <anonymous@discussions.microsoft.com> wrote in message >news:f3e801c43db9$09a244d0$a301280a@phx.gbl... >Thanks in advance for any usefull replies. > >Environment: >Win2k, 2000 FPSE, Intranet > >Question: > >Is it possible to disallow web editors from uploading .exe >files to the content directories, and still allow them to >go about daily content (.asp/.html) updating. > >Editors use Frontpage 2000 or 2002. > > >. >
- Next message: anonymous_at_discussions.microsoft.com: "Server Application Error"
- Previous message: David Wang [Msft]: "Re: Simmulation of form-data posting on one computer?"
- In reply to: anonymous: "Re: .exe uplpoads"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
