file:// urls and Internet Explorer

Question

I have an intranet application, which for many years has made use of the file:// syntax for urls to link to resources on (hopefully) network shares. I know that uploading instead of linking, and perhaps using webDAV would be a better solution, but that is currently outside of the scope of my problem.

Until very recently, accessing a file:// link from a page worked fine. However, recently it has stopped working. I can finds references to mozilla preventing file:// links from working when accessed from an http:// or https:// page, but I cannot find any reference to Internet Explorer implementing the same behaviour. I am assuming a windows update has done this, because even IE6 has started to exhibit this behaviour, and I know for sure that IE6 and IE7 have been working fine. Unfortunately I cannot be sure exactly when it stopped working.

Someone else must have come across this and can give me a definitive answer as to whether this potential security hole has been 'fixed'.

ALl info greatly appreciated

Answer 1

Try adding your site to "Trusted sites", as explained here:

http://windowsxp.mvps.org/ie/elevlocalfile.htm

The issue is a new security feature in Internet Explore 6 Service Pack 1. In order to prevent Internet vicious codes from accessing your local files, the development team developed the new security feature and included it in IE6 SP1. Please be advised that this is a normal behavior. Actually, IE6 SP1 includes new security code checks that prevent "zone elevation". This means that documents located in the "Internet" zone will not be granted access (through HREFs, scripting...etc) to documents in the "My Computer" zone

...

In Windows XP Service Pack 2, no site from any Zone can open files in local machine zone, whereas in pre-SP2, only Internet Zone sites were restricted to open local files, while Trusted/Intranet can.