Cannot use a Leading .. Error

[Will Chamberlain]

I am getting the following error:

Exception Details: System.Web.HttpException: Cannot use a leading .. to
exit above the top directory

The function that throws the error is:

Public Function GetCommentLink() As String

If Not CBool(cfg.GetConfig("cfgLockComments")) And Not
CStr(dtr("post_Comments")).ToUpper = "NOC" Then

Return _
& "<a href=" & cfg.PostPermalinkURI(CInt(dtr("post_ID")),
CStr(dtr("post_Title"))) & ">" _
& loc.GetString("Comments") _
& " (" & CInt(dtr("cmt_CmtCnt")) & ")</a>"

Else
Return ""

End If

End Function
___________________

I've Googled this error and the consensus is that it has something to do
with security in the way you reference a directory. Any suggestions on
how to fix this? It is a blog engine that I am trying to install.

 

[Tim Cartwright]

Go into the IIS virtual directories properties, and on the "Virtual
Directory" tab, click the "Configuration" button. Then on the "Options" tab,
check off "Enable Parent Paths". BTW, there are security reasons this is
turned off by default.
http://support.microsoft.com/default.aspx?scid=kb;en-us;332117 IMHO I would
actually create a virtual dir that points to the parent path.

 

[Will Chamberlain]

Thanks for the prompt response Tim. The only problem is that I am on a
shared host (Brinkster) so I don't have physical access to IIS. Are
there any workarounds for this given my current situation?

 

[Will Chamberlain]

Another interesting aspect of this error:

When I try to visit my site by typing in http://subdomain.mydomain.com I
get the error in question.

If I then type out the full URL that the subdomain references
http://www.mydomain.com/subdomain I do not get the error. After
visiting http://www.mydomain.com/subdomain I can type in
subdomain.mydomain.com, click REFRESH, and the page loads perfectly. I
don't know how to combat this as it seems kind of buggy.

 

[Tim Cartwright]

Not AFAIK, sorry. They will need to change this.

 

[Patrice]

You could try to replace .. with the proper absolute or application web root
relative path...