0

I have a windows web server and i am using xml for the web.config i currently have extensions permissions set to false for .exe, .bin, and .dll

but i made a directory called "thing" with a .exe in it and i want to write in xml permissions for that directory that lets me download .exe files from it

 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
     <system.webServer>
         <security>
             <requestFiltering>
                 <fileExtensions>
                     <add fileExtension=".dll" allowed="false" />
                     <add fileExtension=".exe" allowed="false" />
                     <add fileExtension=".bin" allowed="false" />
                 </fileExtensions>
             </requestFiltering>
         </security>
     </system.webServer>
 </configuration>

help please?

3
  • What do you exactly want to do? Do you want to allow web clients to download .exe files from any public locations on the web server? Feb 13, 2012 at 22:30
  • what is a windows web server? A program similar to Microsoft IIS ? Feb 13, 2012 at 22:33
  • @ lorenzo yes i want that exactly i want it to let one or two folders let .exe files be downloaded from them but not for everywhere else Feb 13, 2012 at 22:35

1 Answer 1

0

From the IIS7 documentation, there are 3 tags that you can use within <requestFiltering> to control URL access:

  • <denyUrlSequences> - This element can contain a collection of URL sequence patterns that IIS 7 will deny; for example: you can deny parts of URL sequences that an attacker might try to exploit.
  • <fileExtensions> - This element can contain a collection of file name extensions that IIS 7 will either deny or allow; for example: you can block all requests for Web.config files.`
  • <hiddenSegments> - This element can contain a collection of URLs that cannot be browsed; for example: you can deny requests for the ASP.NET App_Code folder.

For example:

<requestFiltering>
    <!-- deny access to any URL which contains /private -->
    <denyUrlSequences>
       <add sequence="/private"/>
    </denyUrlSequences>
    <!-- block all file extensions except js,css,html -->
    <fileExtensions allowUnlisted="false">
       <add fileExtension=".js" allowed="true" />
       <add fileExtension=".css" allowed="true" />
       <add fileExtension=".html" allowed="true" />
    </fileExtensions>
    <!-- hide config and bin dir -->
    <hiddenSegments>
       <add segment="config" />
       <add segment="bin" />
    </hiddenSegments>
</requestFiltering>

You can hide some URLs or block some file extensions, but, as far as I can think, it is not possible to fine-tune the accessibility of specific file extensions by folder just changing the IIS configuration. If this is what you want, you'll probably need to write some server-side code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.