Return to Revisions

Assuming that you want the uploaded files to be served as static read-only content:

Inside your root web.config (which can't be overwritten by users), use this (as suggested by Javier G., but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read" />
    </system.webServer>
  </location>

Or this (as suggesteed by LazyOne, but with allowOverride=false):

  <location path="upload" allowOverride="false">
    <system.webServer>
      <handlers accessPolicy="Read">
        <clear />
        <add name="StaticFile" path="*" verb="*" modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" resourceType="Either" requireAccess="Read" />
      </handlers>
    </system.webServer>
  </location>

If you don't use allowOverride=false, anyone can upload a web.config in your open folder, and override your handlers configuration, so that they will be able to run scripts again. See this link for exploit example.