Chapter 10: Using AspUpload in a Shared Environment

When AspUpload is used in a Web hosting environment, the system administrator may choose to disable certain features of the component that he/she deems potentially dangerous, such as saving files in an arbitrary directory, manipulating ACLs, directory listing, file downloading, etc.

The features are disabled by changing the corresponding values in the system registry. To run Registry Editor, type regedit at the Start/Run prompt.

The registry values used to disable the "dangerous" features are located under the key

By default, all the registry values under this key are set to 0 (enabled). Setting them to 1 (or any non-zero value) would disable the corresponding feature.

The following table lists all AspUpload methods that can be disabled via registry settings, and corresponding registry values that disable them:

Some of AspUpload's "risky" features are more dangerous than others. Among the most dangerous are:

• ActiveX registration. Using this feature, a malicious user can place a trojan-horse ActiveX DLL on the server, register and invoke it with simple ASP script.
• Directory Listing. This feature allows users to browser around the entire web server's hard drive and download any files.
• Account impersonation.
• File deletion and directory removal.

After installing AspUpload on a shared Web server, it is recommended that most or all of the potentially dangerous features be disabled, or at least some of the code samples be deleted from the installation directory. This includes: