<% mode=request.querystring("m") if mode="gem" then sti = "billeder/" Set Upload = Server.CreateObject("Persits.Upload") set conn = server.createobject("ADODB.connection") path = Server.MapPath("db/fpdb/sha.mdb") conn.Open "DBQ="& path &";DefaultDir="& path & ";Driver={Microsoft Access Driver (*.mdb)}"
Upload.OverwriteFiles = False Upload.Save (Server.Mappath(sti)) fil1 = "" fil2 = "" fil3 = "" If Not Upload.Files("FILE1") Is Nothing Then fil1 = sti & Upload.Files("FILE1").FileName If Not Upload.Files("FILE2") Is Nothing Then fil2 = sti & Upload.Files("FILE2").FileName If Not Upload.Files("FILE3") Is Nothing Then fil3 = sti & Upload.Files("FILE3").FileName
Det kan være det er noget med skrive rettigheder.... Men det har jo virket, men af en eller anden grund virker det ikke mere.. Jeg har ikke flyttet noget det er sket af sig selv, måske det er noget på serveren der er lavet om.
Jeg fik denne mail, men kan ikke lige se hvad det bevirker hos mig. **********************************
We have discovered an security issue on all hostingaccounts that affects FSO object that can leak information’s to unwanted users and is under siege to be restructured and fixed.
Risk is very high and is being taken care of immediately and should be finished with in 1 – 2 days.
This will change your website structure and permission structure a lot in a form you can see here below:
All sites will get 2 additional folders and each folder has a special purpose to both protect your data and prevent any further information leeks from your sites and data.
-----/(ftproot)domain.com/db <- existing folder ( restricted for databases ) /(ftproot)domain.com/upload <- new folder ( restricted for upload content ) /(ftproot)private <- new folder ( restricted for personal files )
/db is now and will be the only folder you can place mdb databases or other database types that need write access from your website and is structured in a special way to prevent leek of information’s from databases and other important data. /db has nonread nonscript witch means that you serverside scripts like asp can write to it when user enters your site authenticated by iusr but no user can read from this this folder or run scripts from it or with other words only server side scripts like asp can talk to this folder.
This will mean you must locate all your databases for this site with in this folder. This will mean you must (if you have not fallowed the rule of placing databases in this folder) move your paths and databases into this folder.
/upload is now and will be only for uploads to protect your web hotel from being abused when you allow direct uploading trough forms on to your site. /upload has nonscript but has read, this mean that a user can upload files like pictures and txt or files but they can not be executed to get information’s from your site trough scripts like asp or vbs.
This will mean you must relocate any upload folders you have had in many places inside your website into this folder.
/privat is your personal folder and is located behind your webs, this folder is more like your store folder for data you do not want to be in your web but still on the server, there is no access to this folder in any way from your sites.
From the start we have included a /db folder and has bean the folder for databases and has been told to customers tu use and to be the folder to use for the main reason it is the folder that was meant to only have this rights but until now it has had wrong permissions do to problematic ways to centralize the permission deployment.
Why this happens now ? In the start it was not done with actually not the best way of security but the most user-friendly way for customers to easy the usage of there hotel but it has flaws regarding permissions.
Now we have developed a lot more efficient way of web hosting and develop us day by day to offer better and more reliable service and this is a part of It, as our when hosting provides about the cheapest hosting solutions there is, often it has to start somewhere and wait with some solutions until we can, and so we did but after we got a kick in the but when one server got abused by FSO crackers and leaked sensitive information’s when using upload forms that users used and opened holes into our servers we take this action and finish all security steps we had planned to do.
Why is this so risky ? FOS and Asp Upload are 2 of supported components that TalkActive Windows hosting provides and allow direct read and write to the hard disk on the server and then get abused by script kiddies by uploading scripts that use FSO ( File System Object ) to list info from with in your site, and is the most widely used way to crack websites. Day by day crackers and script kiddies are getting more and more scripted and automated and more and more youngsters are having more and more ways to get there hands on scripts that actual hackers have written and make it a lot more important for us to secure our data as well as possible. To day Windows 2003 servers are getting a lot targeted for the reason that they are not getting cracked and exploited and it seems to be a challenge for those who live in the world of cracking/hacking.
We apologize for all inconvenience this will and may cause you but keep in mind this will secure your sites a lot more and a lot more than that as there are about 24 changes to every web hotel to prevent future issues that can possible be used later on and as we self crack our servers and brutalize them to find weaknesses, every way has no been applied that we feel need to in a one big change to your site.
Other changes will fallow but non will affect your site or hosting but will affect other parts of the servers.
With Best of all regards. TalkActive Windows Admin.
Ja ud fra mailen har de begrænset rettighederne i alle folderne pga. sikkerhed.
Der er lavet en ny /upload folder som man skal uploade filer til: "This will mean you must relocate any upload folders you have had in many places inside your website into this folder."
du kan i første omgang prøve at lave sti om til: sti = "/upload/"
Så skulle den gerne kunne upload. Men så ligger filerne i /upload folderen og ikke billeder. Jeg ved så ikke helt hvordan man flytter dem da det umiddelbart også kræver skriverettighed i den folder man flytter dem til.
Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.