English 中文(简体)
视窗服务器2008年7月1日
原标题:Windows Server 2008 r2 security against uploaded scripts

I have developed an asp.net application and windows desktop application system. My clients can upload images to asp.net application(only one folder). So if someone uploads a shell script and executes, one can take the other clients database files. Asp.net application works under windows server 2008 r2(web server edition) OS and IIS 7.5.it has administrator rights for now. I don t have a domain and domain controller so i don t have advanced user rights management. And "applicationpoolidentiy" doesn t help(i even can t open page.). I thought maybe i can deny executing of uploaded scripts? Is it possible. Or are there any better ways to secure server from uploaded scripts?

最佳回答

You should change your upload page to reject all files with extensions that aren t images using an extension whitelist.

为了增加安全,你应召集综合安全局,不要在该名录中执行文字。

问题回答

暂无回答




相关问题
Anyone feel like passing it forward?

I m the only developer in my company, and am getting along well as an autodidact, but I know I m missing out on the education one gets from working with and having code reviewed by more senior devs. ...

How to Add script codes before the </body> tag ASP.NET

Heres the problem, In Masterpage, the google analytics code were pasted before the end of body tag. In ASPX page, I need to generate a script (google addItem tracker) using codebehind ClientScript ...

Transaction handling with TransactionScope

I am implementing Transaction using TransactionScope with the help this MSDN article http://msdn.microsoft.com/en-us/library/system.transactions.transactionscope.aspx I just want to confirm that is ...

System.Web.Mvc.Controller Initialize

i have the following base controller... public class BaseController : Controller { protected override void Initialize(System.Web.Routing.RequestContext requestContext) { if (...

Microsoft.Contracts namespace

For what it is necessary Microsoft.Contracts namespace in asp.net? I mean, in what cases I could write using Microsoft.Contracts;?

Separator line in ASP.NET

I d like to add a simple separator line in an aspx web form. Does anyone know how? It sounds easy enough, but still I can t manage to find how to do it.. 10x!

热门标签