IIS 10 and Custom Error Pages-Executing Twice

问题

In response to the infamous "xmlrpc.php" DOS attacks, I wrote custom error ASP pages for both the 404 and the 500-100 type of errors and got most of it working okay. However, I found that the pages are being executed twice, for unknown reason. They both send emails, and also collect the client's IP, for automatic adding to a Peerblock custom IP block list text file. However, because of the double-execution, two (2) emails are sent, and the IP addresses are added twice to the Peerblock text file. Following is a code snippet listing for the 404 page:

' Grab the current URL and peform a number of tests (if we can--after the IIS server performs a redirection to a 404 handler, the URL is stripped of all parameters):
TheURL = Request.ServerVariables("SERVER_NAME") & Request.ServerVariables("SCRIPT_NAME")
If Request.ServerVariables("QUERY_STRING") <> "" Then
    TheURL = TheURL & "?" & Request.ServerVariables("QUERY_STRING")
End If

strServer = Request.ServerVariables("SERVER_NAME")
strUrl = Request.QueryString
strPage = Mid(strUrl, InStr(strUrl, strServer) + Len(strServer) + 1)
ClientIPAddress = Request.ServerVariables("LOCAL_ADDR")  
HTTPReferer = Request.ServerVariables("HTTP_REFERER")

If HTTPReferer = "" Then
    If InStr(1, ClientIPAddress, "10.1.252.250", 0) > 0 Then 
        HTTPReferer = "www.edenusa.com"
        WithinSite = True
    Else
        HTTPReferer = "UNKNOWN URL" 
        WithinSite = False
    End If
End If

' Grab the IP address of the client coming into site (used later in email and HTML text):
RemoteIPAddress = Request.ServerVariables("REMOTE_ADDR")

' Don't notify via email when the URL is the following (happens too often):
HTTPRefererStatus = InStr(HTTPReferer, "edenusa.com/") OR InStr(HTTPReferer, "www.edenusa.com/") OR InStr(HTTPReferer, "edenusa.com/favicon.ico") OR InStr(HTTPReferer, "edenusa.com/favicon.gif") OR InStr(HTTPReferer, "edenusa.com/robots.txt") OR InStr(HTTPReferer, "xmlrpc.php")
TheURLStatus = InStr(TheURL, "xmlrpc.php")

If HTTPRefererStatus > 0 Or TheURLStatus > 0 Then

    NoEmail = True ' Do not send an email in this case

    If TheURLStatus > 0 Then ' Write the IP address to our own local Peer Block list:
        ' The format of the file is as follows: #[name]:[IpRangeStart]-[IpRangeEnd]

        Dim objFS
        Dim objFile
        Dim IPBlockFileName: IPBlockFileName = "badiplist-edenusa.txt"

        Set objFS = Server.CreateObject ("Scripting.FileSystemObject")
        sIPBlockListPath = Server.Mappath ("/common/errorhandling/badiplists/" & IPBlockFileName)
        Set objFile = objFS.OpenTextFile (sIPBlockListPath, 8)

        ' Write the IP address out to the IP Block List file:
        objFile.WriteLine "#Test: " & RemoteIPAddress & "-" & RemoteIPAddress

        objFile.Close
        Set objFS = Nothing
        Set objFile = Nothing
    End If
End If


' Using Persits ASPEmail component, send an error report email to the support team.

sAlertBody = "At " & Now() & " a 404 error was encountered when a user attempted to visit the following link: " & HTTPReferer & vbCrLf
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The local IP address is: " & ClientIPAddress
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The remote IP address is: " & RemoteIPAddress
sAlertBody = sAlertBody & vbCrLf & vbCrLf
sAlertBody = sAlertBody & "The value of TheURL is: " & TheURL
sAlertBody = sAlertBody & vbCrLf & vbCrLf

'Send email for evaluation:
'Function IsSuccessfulEmail(sFromAddress, sSenderName, sRecipient, sReplyTo, sSubject, sBody, sCarbonCopyAddress, sFileAttachmentLocation)

If NoEmail = False Then

' Call the emailing function (contained in the /INCLUDEFILES/EMAILOPERATIONS/EMAILFUNCTIONS.ASP file):

    ' Call the AdministrativeAlertEmail() function:
    AlertEmailResult = AdministrativeAlertEmail(sAlertRecipient, sAlertSubject, sAlertBody, sAlertHost)

        If Debug_404ErrorPage = True Then
            Response.Write("LINE-178: This is the value of the AlertEmailResult variable: ") & AlertEmailResult & "<br>"
            Response.End
        End If

Else ' Do not send an email, and reset the variable back to TRUE:

    NoEmail = True

End If

回答1:

The IIS Custom Error pages tool allows the definition of a custom error page via the "Error Page" mechanism. Each Status Code type (e.g., 500), can be edited to include a relative path to your own custom error page. Unfortunately, I discovered that Server.GetLastError() method that I instantiated in the 500 page, returns only null values. An article on the net described a solution whereby the "Edit Feature Settings..." in IIS could be used to point to a "Default Page." This unfortunately, caused all other defined Custom Error Pages to be executed twice. Upon removing the custom 500 error page (as suggested by Lankymart), the problem described in this post was resolved.

来源：https://stackoverflow.com/questions/61627238/iis-10-and-custom-error-pages-executing-twice

标签

vbscript

asp-classic

iis-10