Err Msg: Active Server Pages, ASP 0131 Disallowed Parent Path (226474)

We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 6.0 running on Microsoft Windows Server 2003. IIS 6.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:

http://www.microsoft.com/technet/security/prodtech/IIS.mspx

SYMPTOMS

When you use relative paths in include statements with Microsoft's Active Server Pages (ASP), browsing a Web page may return an error message similar to the following:

Active Server Pages, ASP 0131
Disallowed Parent Path
The Include file '../<filename.ext>' cannot contain '..' to indicate the parent directory.
/<path>/<filename.ext>, line <number>

CAUSE

This is caused by disabling ASP's "parent paths" for a Web site or application while using relative parent paths in an include statement.

Relative parent paths in include statements use the following form:

<!--#include file="../<filename.ext>"-->

RESOLUTION

The best solution to the problem is to use absolute virtual paths from the root of the Web site instead of relative paths.

For example, if you use an include file named "mycode.inc" at the root of your server, the virtual path would be "/mycode.inc." If you use the same include file in a virtual directory named "/includes" on your server, the virtual path would be "/includes/mycode.inc."

The syntax example below illustrates how to implement virtual paths:

<!--#include virtual="/<virtual path>/<filename.ext>"-->

An alternative to using absolute virtual paths is to enable parent paths; however, this is not the preferred method. (See the notes in the More Information section for details.) This is accomplished for your default Web site by using the following steps:

Open the Internet Services Manager in the Microsoft Management Console (MMC).
Right-click on your Default Web Site and select Properties.
Click the Home Directory tab.
Click the Configuration button.
Click the App Options tab.
Click to select the Enable Parent Paths checkbox.
Click the OK button until you return to the MMC.

MORE INFORMATION

There are additional security considerations to be considered when enabling parent paths on an IIS computer. For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

184717 AspEnableParentPaths MetaBase Property Should Be Set To False

332117 Enable Parent Paths Is Disabled by Default in IIS 6.0

For more information about troubleshooting this and other ASP errors that may occur with IIS 6.0, visit the following Microsoft Web sites:

Troubleshooting and Important Changes in ASP
http://technet2.microsoft.com/windowsserver/en/default.mspx