Deny code execution IIS7 with web.config

Question

I want to block users run specific extensions in an upload folder (/assets/public/) of a web application. Users can upload image files which are also re-sized during the upload. But for more security I want to deny scripts like aspx, asp, php...

I have current code which blocks every extension but I want to allow extensions like .jpg:

<location path="assets/public">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>

Also users do not have FTP access and application is pre-compiled.

Do you mean a hosting case? When user using local Web.config registers own extension to use? — abatishchev, Apr 10 '11 at 19:30
Users have granted upload access only to assets/public folder and customer has no FTP. I don't want user or hackers to be able to run remote scripts. — HasanG, Apr 10 '11 at 19:47

score 0 · Answer 1 · answered Apr 10 '11 at 19:25

0

Try

<httpModules>
    <clear />
</httpModules>

or

<location path="." inheritInChildApplications="false">
</location>

answered Apr 10 '11 at 19:25

abatishchev

98,240
88
296
433

"An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode." error after first option and second one not working. – HasanG Apr 10 '11 at 19:48
@Hasan: See [this qeestion](http://stackoverflow.com/questions/4209999/an-asp-net-setting-has-been-detected-that-does-not-apply-in-integrated-managed-pi) regarding the first issue – abatishchev Apr 10 '11 at 19:51

score -2 · Answer 2 · answered Apr 12 '11 at 06:36

Here is how I solved this with global.asax and routing. Just added these rules:

routes.MapPageRoute("any", "assets/public/{file}.{ext}", "~/e/404.aspx");
routes.MapPageRoute("any-sub","assets/public/{sub}/{file}.{ext}","~/e/404.aspx");

routes.Ignore("{any}.jpg");
routes.Ignore("{any}.png");
routes.Ignore("{any}.gif");
routes.Ignore("{any}.pdf");

Deny code execution IIS7 with web.config

2 Answers2