IIS 7 允許檔案名稱有+ 號

解決方式:

使用 [以系統管理員身分執行] 選項開啟命令提示字元，並將目錄變更至 %windir%\system32\inetsrv

啟用雙重逸出，請在命令提示字元輸入下列命令，然後按 ENTER：

appcmd set config /section:requestfiltering /allowdoubleescaping:true

執行畫面:

相關文章:

http://technet.microsoft.com/zh-tw/library/cc754791(WS.10).aspx

IIS7 rejecting URLs containing + .

Here is the deal. The IIS7 request filter rejects URLs containing + characters. We do this because the + character is a dangerous choice. Some standards, e.g. the CGI standard require +'s to be converted into spaces. This can become a problem if you have code that implements name-based rules, for example urlauthorization rules that base their decisions on some part of the url.
Here is a cooked up example:
Let's suppose you have code that evaluates the following rule:



With the ambiguity of leaving +'s in place or converting +'s to spaces there is a possiblity that your rule engine allows access to a non-Admin, for example if the attacker enters http://myserver/my+vdir. The "my vdir" authorization rule won't match because your authorization code searches for the string "my+vdir" but your rule says "my vdir". Your rule won't apply and the attacker gets access.

If you absolutely want to have spaces you can simply turn off the doubleEscaping feature for your application, for your site or for the whole server. Here is an example:

%windir%\system32\inetsrv\appcmd set config "Default Web Site" -section:system.webServer/security/requestfiltering -allowDoubleEscaping:true