I have developed an asp.net application and windows desktop application system. My clients can upload images to asp.net application(only one folder). So if someone uploads a shell script and executes, one can take the other clients database files. Asp.net application works under windows server 2008 r2(web server edition) OS and IIS 7.5.it has administrator rights for now. I don t have a domain and domain controller so i don t have advanced user rights management. And "applicationpoolidentiy" doesn t help(i even can t open page.). I thought maybe i can deny executing of uploaded scripts? Is it possible. Or are there any better ways to secure server from uploaded scripts?
In my webpages I have references to js and images as such: "../../Content/Images/"Filename" In my code if I reference a file as above, it doesnt work so i have to write: "c:/miscfiles/"filename" 1-...