The blog of Russ (snake) Michaels - WEBBY STUFF

IIS7 blocks viewing access to certain folder names

Tue, 03 Aug 2010 20:14:00 --0100

I was just asked to help someone troubleshoot a site that worked fine on previous host but didn't work on Windows Server 2008 / IIS7. None of the images on certain pages were displaying, the image path looked something like this:

http://www.sitename.com/subfolder/bin/file.jpg

The subfolder wasn't marked as an application, although that doesn't really matter. The point is that since /bin/ was in the path somewhere, and it turns out that IIS7 wont allow any file to be displayed with a /bin/ in the path. It serves up a 404.2 error saying file or directory not found.

404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.If you look

If you look in applicationHost.config you will find the following under the <requestFiltering> section:

      
    <hiddenSegments applyToWebDAV="true">

      <add segment="web.config" />

      <add segment="bin" />

      <add segment="App_code" />

      <add segment="App_GlobalResources" />

      <add segment="App_LocalResources" />

      <add segment="App_WebReferences" />

      <add segment="App_Data" />

      <add segment="App_Browsers" />

    </hiddenSegments>

So, IIS7 now blocks those key folders and doesn't allow them to be seen. To the outside world, any page in any of these folders appears to not exist.

The easy solution is to change the folder name, but there may be times when you really do want to keep the path name, such as for SEO purposes. Not to worry, it can be changed easily enough. This setting in on purpose though as it is for asp.net, so you usually shouldn't remove it for the whole site.

If it is your own server then you can use AppCmd or do it manually from applicationHost.config or web.config. Since requestFiltering is allowed to be set at the site or folder level by default, it's probably best to set a web.config file in the folder that you want to allow, which is your only option on shared hosting.

To do this on a per folder level, create a web.config file in your folder and type or paste the following into it. It should look something like this:

    <?xml version="1.0"?>

        <configuration>

          <system.webServer>

            <security>

                <requestFiltering>

                    <hiddenSegments>

                      <remove segment="bin" />

                    </hiddenSegments>

                </requestFiltering>

            </security>

          </system.webServer>

    </configuration>

If you want to make the change to your applicationHost.config file instead, you can do it by adding a location tag to the bottom of the file (well, almost the bottom - along with the other location tags) like this:

    <location path="sitename.com/subfolder/bin/debug">

        <system.webServer>

            <security>

                <requestFiltering>

                    <hiddenSegments>

                        <remove segment="bin" />

                    </hiddenSegments>

                </requestFiltering>

            </security>

         </system.webServer>

    </location>

To do this using AppCmd just drop to the command prompt and type the following: (Be sure to change the paths to the correct page before running this.)

C:\Windows\System32\inetsrv\appcmd.exe set config "sitename.com/subfolder/bin/debug" -section:system.webServer/security/requestFiltering /-hiddenSegments.[segment='bin']

After making this change, you will be able to view pages normally, even if they have /bin in the site path.

What OS are web developers using?

Tue, 20 Jul 2010 17:58:00 --0100

The open source PHP dynamic language is one of the most widely deployed languages on Web servers today. But what operating systems are PHP developers using to develop and deploy their applications? It's a question that has been asked before and now it's being answered with a new study from Zend, one of the lead commercial backers behind PHP.

The study surveyed 2,000 PHP developers in December and found that 85 percent reported that Linux was their primary operating system as a production environment for PHP.

Windows came in at a distant second at 11 percent while Mac OS X came in third at just 2 percent. However, when Zend drilled down into which platforms respondents prefer for their development, the rankings change dramatically.

According to the study, 42 percent of respondents reported that Windows was their primary operating system for development. Linux came in as No. 2 at 38.5 percent while Mac OS X remained in third place at 19.1 percent.

The findings indicate that while Microsoft Windows remains the top platform for developing in PHP, its lead may be narrowing. Back in 2006, a Microsoft executive reported that 85 percent of PHP developers were developing on Windows, but only 20 percent deployed on a Windows machine. The change comes despite joint work by Zend and Microsoft to improve the capabilities of PHP on Windows servers.

that the new study was based on over 2,000 completed surveys conducted in December 2009, some of which came from Zend customers. The survey was made public through the Zend Framework website, the Zend monthly newsletter, Twitter and DevZone.

I have also noticed recently from reading blogs and lists that the majority of CFML open source developers seem to deploy Railo or Open BlueDragon on Linux, which is a major paradigm shift from ColdFusion developers who primary use Windows.

I don't think this is a matter of preference but rather one of necessity as pretty much all the PHP documentation is for Linux, most PHP apps are written for Linux/Apache and are not supported on windows even if you can get them working.

If you have tried to install Railo then will have discovered this can also be quite a task and a challenge to get working, especially on windows/IIS7, and there are far more blog posts and docs explaining how to get it running on Linux, as well as ready made virtual disk images, which I suspects encourages people to take the path of least resistance and install Linux.

In the case of CFML this does however tend to be done using virtualisation software such as virtualbox or vmware to run a linux development servers on windows, so cfml developers do still seem to be using windows as their primary desktop OS, so I do wonder if Zend took this into consideration with their study and if many of those who listed Linux as their primary development OS may in fact be running it as a virtual machine on windows. This feeling is further extrapolated by the fact that developers are mainly using servers distros like CentOS.

You also need to consider all the obvious facts as well:- While Linux has a lot going for it and plenty of software, most of the best/popular software, especially web dev/design products like Dreamweaver and the rest of the Adobe line is not available on Linux. Sure there are alternatives, but they are certainly not in the same league and you can't walk into PC World and buy any of it. For those who have always been running a Linux desktop this will of course not matter at all, but for the rest this will be a big issue, especially if it is software you have spent a lot of money on, so running a virtual machine makes sense.

Of course it could be the other way round entirely and developers are running a windows VM on linux, but this would seem an off way of doing it if their primary tools are on windows.

Before the Linux fanboys start ranting, let me make it 100% clear that this is not a linux vs windows slanging match and I will delete all churlish comments attempting to turn it into one. If you comment keep it on-topic and professional.

ZendPHPviaFastCGI Gives 500 Internal Server Error

Wed, 17 Feb 2010 16:54:00 --0100

Been having a fun time today trying to get Magento CMS working. The bizarre situation was that PHP would work fine under the default web site, but not under any other web site, which would result in a 500 Internal Server Error caused by the ZendPHPviaFastCGI PHP handler mapping. See screenshot below. I of course tried every possible solution without success, the cause turned out to be rather obscure.

What was required to fix this was to manually add this attribute to the handler mapping in the applicationHost.config file, which you will find in C:\Windows\System32\inetsrv\config.

     allowPathInfo="true"

PathInfo refers to the additional path information that may follow the file name and extension in a Uniform Resource Identifier (URI). For example, if you request the URI http://localhost/test.dll/myinfo, the PathInfo portion of that URI is /myinfo

This parameter does not seem to exist in the IIS Manager and is not even mentioned in the handler docs so I really do really not know why this is required or why it is not there by default and why you cannot add it via the GUI.

So the final entry for my ZendPHPviaFastCGI handler looked like this.

    <add name="ZendPHPviaFastCGI" path="*.php" verb="*" modules="FastCgiModule" 
scriptProcessor="C:\Program Files (x86)\Zend\ZendServer\bin\php-cgi.exe" 
resourceType="Either" requireAccess="Script" allowPathInfo="true" />

Credit must go to my buddy Matt Gahan for working this one out.

PCI Compliance for Dummies

Thu, 28 Jan 2010 14:03:00 --0100

PCI DSS compliance is now a legal requirement for anyone with merchant services, having just had to go through this myself and knowing that our clients are also going to have to do the same, I started searching for a simple guide that I could pass on to clients and came across this book.

Complying with the PCI Data Security Standard may seem like a daunting task for merchants. This book is a quick guide to understanding how to protect cardholder data and comply with the requirements of PCI - from surveying the standard's requirements to detailing steps for verifying compliance.

PCI Compliance for Dummies arms you with the facts, in plain English, and shows you how to achieve PCI Compliance.

And yes my company BlueThunder Internet is fully PCI DSS compliant before you ask :-)

Time Tracking and Source Control for FREE

Mon, 14 Dec 2009 17:52:00 --0100

For quite some time now I have been using ProWorkFlow for my time tracking and project management, which I found to be the most fully featured of all the project management solutions I tried and really is very good. However the amount of development work I do these days is very small, so I couldn't really warrant paying for something that gets used so rarely, so I decided it was time to look for an alternative and preferably FREE solution. [More]

Adobe Incontext Editing

Fri, 09 Oct 2009 15:31:53 --0100

I recently came across this rather nifty new service (called ICE for short) from Adobe, which essentially allows you to add basic content management facilities to any website with zero coding and allow your clients to manage it via their browser. You just take a simple flat HTML page, add in some markup to identify editable regions and your done. Granted it has very basic WYSIWYG capabilities, but it is perfect for those small clients who only want basic editing capabilities and don't have much money to spend on implementing a fully featured solution even with an open source CMS such as the very cool Mura CMS.

If you already use Dreamweaver then you already have everything you need to get started and easily create Incontext editable regions, but there are in fact no special requirements for using this service, you do not need to use Dreamweaver other than to create the javascript files, so you could in effect just download a Dreamweaver trial to see how it works and get the code then you can insert the required markup via notepad if you wish. To use the service all you need to do is sign up for an Adobe ID, and then login to the IncontextEditing Admin portal. From here you setup and manage your sites. Check out the getting started video below.

Currently the InContext Editing service is FREE and in the forums Adobe have quoted that it will remain free until 2011, after which it will be a subscription service costing $10-$20 per month. This information was actually quite hard to find, I tried calling Adobe to enquire about pricing, I spoke to customer services, sales and technical support and amazingly no-one had any idea what Incontext Editing was or that it was even an Adobe product.

To get started with ICE try out these tutorials.