Problemer med kode efter omlægning hos udbyder

Hej! Jeg har haft nedenstående kode til at køre i flere måneder og det har virket upåklageligt. Det har kørt hos web10. Men her omkring jul udsendte de en mail hvor de beskrev nogle ændringer som blandt andet betød at db mappen blev flyttet. Men siden har min test af om der er hak i et afkrydsningsfelt ikke virket. Kan i gennemskue om de 2 ting hænger sammen ?

Her er den fil der gemmer i databasen og skulle sende en videre hvis der er hak i afkrydsningsfeltet :

<!-- #include file="db.inc" -->
<%
'Dimension variables
Dim adoCon              'Holds the Database Connection Object
Dim rsAddComments  'Holds the recordset for the new record to be added
Dim strSQL              'Holds the SQL query to query the database

'Create an ADO connection object
Set adoCon = Server.CreateObject("ADODB.Connection")

'Set an active connection to the Connection object using a DSN-less connection
adoCon.Open "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" & Server.MapPath("../db/brugtebiler.mdb")

'Create an ADO recordset object
Set rsAddComments = Server.CreateObject("ADODB.Recordset")

'Initialise the strSQL variable with an SQL statement to query the database
strSQL = "SELECT biler.mark, biler.model, biler.aar, biler.km, biler.pris, biler.farve, biler.udstyr, biler.comment, biler.kategori, biler.ip FROM biler;"

'Set the cursor type we are using so we can navigate through the recordset
rsAddComments.CursorType = 2

'Set the lock type so that the record is locked by ADO when it is updated
rsAddComments.LockType = 3

'Open the recordset with the SQL query
rsAddComments.Open strSQL, adoCon

'Tell the recordset we are adding a new record to it
rsAddComments.AddNew

'Add a new record to the recordset
rsAddComments.Fields("mark")              = Request.Form("mark")
rsAddComments.Fields("model")             = Request.Form("model")
rsAddComments.Fields("aar")              = Request.Form("aar")
rsAddComments.Fields("km")                 = Request.Form("km")
rsAddComments.Fields("pris")            = Request.Form("pris")
rsAddComments.Fields("farve")             = Request.Form("farve")
rsAddComments.Fields("udstyr")          = Request.Form("udstyr")
rsAddComments.Fields("comment")         = Request.Form("comment")
rsAddComments.Fields("kategori")        = Request.Form("kategori")
rsAddComments.Fields("ip")                = Request.ServerVariables("REMOTE_ADDR")


'Write the updated recordset to the database
rsAddComments.Update

'Reset server objects
rsAddComments.Close
Set rsAddComments = Nothing
Set adoCon = Nothing

'find id som vi lige har sat ind.
sqlo = "SELECT max(ID_no) FROM biler"
Set rso = dbc.Execute(sqlo)   

oid = Cint(rso(0))

if Request.Form("billede") = "on" then
Response.Redirect "admin_indlaes_fil.asp?id=" & Server.URLEncode(oid)
else
Response.Redirect "view_selected.asp?id=" & Server.URLEncode(oid)
end if


%>


Og her er mailen de har sendt ud :

Dear xxxxx.
We have discovered an security issue on all hostingaccounts that affects FSO object

that can leak information’s to unwanted users and is under siege to be restructured and

fixed.

Risk is very high and is being taken care of immediately and should be finished with in 1 – 2 days.

This will change your website structure and permission structure a lot in a form you can see here below:

All sites will get 2 additional folders and each folder has a special purpose to both protect your data and

prevent any further information leeks from your sites and data.

Your basic structure is as fallows:

------ /(ftproot) /domain.dk/db

/(ftproot) /domain.dk

and will be changed to fallowing structure:

-----/(ftproot)domain.com/db <- existing folder ( restricted for databases )

/(ftproot)domain.com/upload <- new folder ( restricted for upload content )

/(ftproot)private <- new folder ( restricted for personal files )

/db is now and will be the only folder you can place mdb databases or other database types

that need write access from your website and is structured in a special way to prevent leek of

information’s from databases and other important data.

/db has nonread nonscript witch means that you serverside scripts like asp can write to it when user

enters your site authenticated by iusr but no user can read from this this folder or run scripts from it

or with other words only server side scripts like asp can talk to this folder.

This will mean you must locate all your databases for this site with in this folder.

This will mean you must (if you have not fallowed the rule of placing databases in this folder) move your paths and databases

into this folder.

/upload is now and will be only for uploads to protect your web hotel from being abused when you

allow direct uploading trough forms on to your site.

/upload has nonscript but has read, this mean that a user can upload files like pictures and txt or

files but they can not be executed to get information’s from your site trough scripts like asp or vbs.

This will mean you must relocate any upload folders you have had in many places inside your website

into this folder.

/privat is your personal folder and is located behind your webs, this folder is more like your store folder

for data you do not want to be in your web but still on the server, there is no access to this folder

in any way from your sites.

>From the start we have included a /db folder and has bean the folder for databases and has

been told to customers tu use and to be the folder to use for the main reason it is the folder that

was meant to only have this rights but until now it has had wrong permissions do to problematic

ways to centralize the permission deployment.

Why this happens now ?

In the start it was not done with actually not the best way of security but the most user-friendly way

for customers to easy the usage of there hotel but it has flaws regarding permissions.

Now we have developed a lot more efficient way of web hosting and develop us day by day to offer

better and more reliable service and this is a part of It, as our when hosting provides about the cheapest

hosting solutions there is, often it has to start somewhere and wait with some solutions until we can, and so

we did but after we got a kick in the but when one server got abused by FSO crackers and leaked sensitive

information’s when using upload forms that users used and opened holes into our servers we take this action

and finish all security steps we had planned to do.

Why is this so risky ?

FOS and Asp Upload are 2 of supported components that TalkActive Windows hosting provides and allow direct

read and write to the hard disk on the server and then get abused by script kiddies by uploading scripts that use FSO

( File System Object ) to list info from with in your site, and is the most widely used way to crack websites.

Day by day crackers and script kiddies are getting more and more scripted and automated and more and more

youngsters are having more and more ways to get there hands on scripts that actual hackers have written and

make it a lot more important for us to secure our data as well as possible. To day Windows 2003 servers are

getting a lot targeted for the reason that they are not getting cracked and exploited and it seems to be a challenge

for those who live in the world of cracking/hacking.

We apologize for all inconvenience this will and may cause you but keep in mind this will secure your sites a lot more

and a lot more than that as there are about 24 changes to every web hotel to prevent future issues that can possible

be used later on and as we self crack our servers and brutalize them to find weaknesses, every way has no been applied that

we feel need to in a one big change to your site.

Other changes will fallow but non will affect your site or hosting but will affect other parts of the servers.

With Best of all regards.

TalkActive Windows Admin.