500 Internal IIS7 Server Error Coded URL

Question

I am using N2Cms and I am looking at some problems that I have. It has a navigation bar on the left side that loads via ajax when expanding the tree.

The code that gets the childeren node calls the ashx file with some parameters. One parameter is for the path and contains slashes in it. For this reason, it was encoded.

.../cms/Content/Navigation/LoadTree.ashx?target=preview&selected=%252fhome%252fhelp-and-advice%252f 

I did not have any problems with this on my development server (running iis 7.5), but when deploying to our test server (iis7) the navigation does not work.

Examination of this showed that the above url gives a 500 error.

If I decode url to

 .../cms/Content/Navigation/LoadTree.ashx?target=preview&selected=/home/help-and-advice/ 

It works without problems.

Unfortunately, I cannot change the code that generates this as part of the n2cms source code, and I assume that it was encoded for a good reason.

Does anyone know anything that I can do in my web.config to allow encoded parameters or something that I can change on the iis server?

EDIT: So this link seems to suggest that it does this on purpose as a security measure. http://msdn.microsoft.com/en-us/library/ee656542.aspx

The proposed solution is to upgrade to .net 4.0 and add the following to web.config:

 <configuration> <uri> <schemeSettings> <add name="http" genericUriParserOptions="DontUnescapePathDotsAndSlashes"/> </schemeSettings> </uri> </configuration> 

Unfortunately, this has no effect.

Any ideas why this is not working?

Answer 1

This may be a URLScan utility. URL Scan blocks the rule-based URL in this configuration file. It also has its own log file, so you can tell for sure by looking at the URLScan log.

Make the default google search for URLSCan.

Answer 2

It seems your url goes through 2 html encode. Is URL rewriting module active on your IIS7 server?

Answer 3

OK, I get something with this.

When I tried to find an error in IIS logs and crashes, looking at a lot of messages about a failed trace request and still not getting any errors in iis, I realized that the request just did not get into IIS.

Looking back at the server error, there was a hint.
500 is an internal server error. The request was rejected by the HTTP filter.

This is a firewall !! We disabled the HTTP filter, and now it works :)

Now I need to find out what this HTTP filter was supposed to protect, and now we can protect it, we disabled it.