Hello,

There is a long story behind this but a third party is redirecting results from their site to DNN.  The URL that they are using to send the user back to our DNN site contains the characters ../

The URL looks something like this: 

[domain name]/Default.aspx?tabid=564&Token=FF537B18-8FEE-41A5-8F3A-648A65D83F76&ContinueURL=http://iweb.signs.org/iWeb/Profile/../messagePage.aspx%3fKey%3daccountOKMsg%26Icon%3diconMsgOk%26Module%3d10

The above URL causes the generic DNN error page to be displayed.  If I remove the ../ between Profile/../messagePage.aspx, then the page is displayed in DNN fine.  Why does the ../ cause an error.

We are running DNN 5.5 on IIS 6 and Windows Server 2003.  I am not sure if this is a DNN issue or an IIS issue.

tkr : the DNN Url Rewriting contains an explicit check to throw a 404 error if ../ is detected anywhere in the Url.  That's why you see the DNN Error page, probably because you have 5.5.1 which just throws the DNN error page on any error (including 404s)

This is because the use of ../ is an attack vector that hackers can use to try and gain access to folders in a site that they aren't authorised for.

The comments in the code are thus:
fix for ASP.NET canonicalization issues http://support.microsoft.com/?kbid=88...

My suggestion would be request that the Url is passed along differently.  Otherwise you'd have to compile a custom version of the Url Rewriting with that particular piece of security checking code removed.

HTH