.shtml extension in VI

[frogggg]

Would anyone know why VI does not let me change the extension of an .html to .shtml, and instead leaves in as fileName.shtml.html?

If this is by design, does anyone know another way to include SSI in an html page in Visual Interdev?

Thanks!

 

[Wullie]

Hi mate,

You can check out the following script which allows you to simulate the use of SSI in any page.

http://smartcgis.com/includer/

One thing to remember, make sure that the password in your script is secure as this is a huge security thread otheriwse. The filename is enctypted depending on your password, if someone finds out this password then they have full access to any files on your machine..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[frogggg]

Wullie,

Could you please explain what the tag is and what are the security concerns?

Thanks.

 

[Wullie]

Hi mate,

All that this this tag does is pass a unix path to the cgi script and then the script decrypts it and displays the contents of the file that you specify.

For example,

Using the password "test" and file path /

http://www/test/index.html

would give you an encypted tag something like the following.

<script src=&quot;

http://yourdomain.com/includer.cgi?sfafassfzpaksnsyzp&quot;></script>

You place this on your page where you want the Include, and it reads that file and returns the contents (Just the same as SSI)

The security threat comes into it becuase the user can view source and see the tag (Unlike SSI) but they still won't see your password..

If a user knows your password for the script, then they could for example encrypt a path to any file on your server and then call the file directly in their browser.

Lets say that they use the path /www/ and there are multiple domains within this direcotry. The user enters the encrypted path using your password and calls it in the browser as something like

http://yourdomain.com/includer.cgi?sfdfgdfdgfdgdfgdfg

This will show them the /www/ directory and they then can browse the files held within..

If you use a good password then this eliminates this threat..

Hope this helps Wullie

http://www.freshlookdesign.co.uk

http://www.searchit-now.co.uk

http://www.survivorhelp.co.uk

 

[frogggg]

I found an answer in the Interdev forum.
If you put the file name in quotes in the saveas textbox, IE will take your word for it instead of assuming that they know better.
So I was able to use the SSI after all.
Thanks again!