ASP 3.0 Folder/File Permissions Settings (ASP Classic)
- by ASP Pee-Wee
Dear Stack Exchange,
Hi, I have built a form input page in HTML that
has an action to post to an ASP handler/processor
.asp file. The form handler/processor .asp file
contains only <% Insert VBScript Here % and no
HTML output whatsoever.
The .asp file was never intended to be a
"web viewable" .asp file like an .asp home page
file or html file would. It's supposed to be
for my eyes only- not the public's however
it does need to take info posted by the public
and do something with it on it's end.
I have used VBScript/ASP3.0 to build the form
handler/processor file and would like to know how
to keep someone from viewing the actual VBScript
in the handler/processor .asp file. I am aware of
obfuscation but I would like to know how to keep
prying eyes from even being able to take a look
at the obfuscated code in the handler/processor
file.
I realize that the server executes the .asp file
first before outputting anything to the browser so
I guess that my main concern is mostly that someone
may could "download" the form handler/processor .asp file,
then view it's contents on their machine.
Assuming the form handler .asp file is where it is,
behind the root, and is on a windows server
(no htaccess approach) how could one protect it so that
it could never be viewed or simply pulled down via
anonymous ftp or something like that?
Is there something like "script only" permissions that
the system administrator could set up for a particular
folder? Remember, with shared hosting I can't go above
the root. If so, would the form still be able to post?
How would any of you guys go about protecting the
asp file in addition to obfuscation? Any help would
be greatly appreciated.
Thanks,
ASP Pee-Wee
