My Website has been attacked by using forum module.

I contacted with Chatal about the problem and he responded very quick.

After I received Chatal's email I tried setting word filter on Forum module. And it worked :)

I have just changed every "script" word to br "sccript" in order to be able to prevent any script insertion... Do not for get to enable word filter for subject field too...

I hope this will protect you from attacks, until the new release...

Thank you for your quick response Chatal....

DV, not sure what control panel you are using, but you have to remember there are 2 identities at work when running any ASP.NET application under  IIS. One is a user that is used by IIS to access files and folders in your webroot. For public websites that is usually an anymous user (not authenticated by windows), by default called IUSR_[Machinename], and it seems that this is the screen that is used by the control panel to define rights for the anonymous user in IIS.

The other identity is the one that is used by the IIS application pool where your application runs. This is the identity that is assigned to the ASP.NET process, and in turn is used by ASP.NET when any file based operations are performed. The windows default name for that user is IWAM_[Machinename]. You can find out what user is used to run your DNN application, by logging on as host and view Host Settings. (look for ASP.NET account)

You really should talk to your provider about stuff like this, and ask him whether you can set access rights on physical files somewhere in your control panel

DNN Blog | Twitter: @erikvb | LinkedIn: