Re: ASPX form Uploads a file even without IIS Write permission

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 08/21/05

  • Next message: David Wang [Msft]: "Re: KB 834489 - workarround" 
    Date: Sun, 21 Aug 2005 00:46:29 -0700

    By design due to how it is configured.

    http://blogs.msdn.com/david.wang/archive/2005/08/20/Why_can_I_upload_a_file_without_IIS_Write_Permission.aspx 

    -- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"FB" <FB@discussions.microsoft.com> wrote in message
news:B9069C32-8121-42BD-A591-CF04B3EDE0E2@microsoft.com...
A customer have a IIS 6 web server and even with IIS Write property
DISABLED,
an ASPX form can upload files to the server.
The authentication is Anon (via IUSR_ user) and the IUSR_User have RWXD
rights on the folder where the upload  is stored.
In the properties of the IIS folder where upload is done, the Read
permission is set, but Write, SourceAccerss and Browse are disabled.
Why the upload works???
  • Next message: David Wang [Msft]: "Re: KB 834489 - workarround"

    Relevant Pages

    • ASPX form Uploads a file even without IIS Write permission
      ... A customer have a IIS 6 web server and even with IIS Write property DISABLED, ... rights on the folder where the upload is stored. ... In the properties of the IIS folder where upload is done, ...
      (microsoft.public.inetserver.iis.security)
    • Re: ASPX form Uploads a file even without IIS Write permission
      ... > solely responsible for making your custom configuration secure. ... > authentication/authorization does not lock down everything and leaves the ... IIS simply has no idea whether a given POST request is ... > ASP Upload, what the purpose of the Write IIS property? ...
      (microsoft.public.inetserver.iis.security)
    • RE: User name and password dialog refresh after 3 mins
      ... you are encountering some strange IIS authentication ... Submit the CSV file to server and parsing the file to store data objects ... | 1 User chooses a CSV file to upload ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: IIS 6 ASP: Which Process Identity Is It Using? App Pool or Anon?
      ... It is actually not an upload application. ... would need the write privileges or that both the IUSR and the TestService ... If everything works, the memory mapped files ... > I doubt if the behavior you met is caused by IIS caches IUSR ...
      (microsoft.public.inetserver.iis)
    • Re: Upload best practice help !
      ... Make sure no IIS directory has script/executables permission, ... this assumes that you do not have HTTP-accessible script ... if you upload the binary outside of HTTP namespace if you have an HTTP- ... particular environment like inetpub. ...
      (microsoft.public.inetserver.iis.security)