#### Read access

The files can be read from this directory. This attribute concerns mostly the default ALP module that serves the files not handled by the other modules (such as ASP, CGI and so on). In some cases it could be useful to reset this flag in order to prevent user from seeing some files linked in a mistake. On a WEB server this flag will have important security meaning, but in ALP it is almost decorative because the files are on the local machine. This flag may help also for broken links tracking.

#### Run scripts

If set permits all the file extensions configured as "Treat as script engine" to be executed. By default only ASP pages and RAW scripts are of this type but you may need to configure some CGI processors and allow them run.

#### Execute

This permits all the ALP modules (except the default module) to run if they are not configured as "Treat as script engine". This flag and the previous allow you to distinguish the file processed as script and the files that are executed directly (such as the EXE files). Sometimes it could be useful to forbid the execution in order to prevent the user to start an application which may cause some damage or may have unexpected behavior. For example if you have EXE files for download you will want to avoid executing them as CGIs.

#### Directory browsing

If there is no default document in a certain directory ALP will execute the Directory browsing module which will display a HTML view of the directory. This flag permits or denies it.

#### Caching

This flag is very important in case you have content that will be processed/shown by external applications (not IE/ALPFrame). In such case it is strongly recommended to set it. The reason for this is in the fact that many applications require normal local files as input and without this option set ALP will not create even a temporary file and there will be no way to pass the generated information to these applications. For example older versions of MS Word/Excel, any application that is not internet enabled and so on.

#### Run expired pages

When you leave a page which is a result of a form post, for example, you may need to return to it later by clicking the back button/menu. In such case ALP will have two choices: to resubmit the posted information (the page will be executed again), or to display the Page expired message. If the flag is set the page will be executed again with the same data. Be careful when using this option and check if the page execution will not produce unexpected results - such as repeated records in the DB.

#### Prevent unattended execution

When this flag is set ALP tracks the pages served from this directory and its sub-directories. The first request pointing in this directory must be to one of the default documents (see below). If another page is referred ALP will show an error stating that the application needs safe entrance. Thus if a malicious user prepares an online WEB page intended to invoke a page in this directory with parameters that will cause it to perform a harmful operation the action will be stopped. On the other hand if the first request to a resource in this directory is to one of its default documents it is assumed that the user has invoked the application intentionally and the directory is unlocked - further requests to any page will succeed. This feature gives almost full protection from hacker attacks with minimal efforts. The developer needs only to take care to not implement potentially harmful features in the default pages. If an ASP pages or CGI applications wants to lock the directory again it can send a ALPHeader-ResetSafeEntrance header. After this header is sent the directory must be unlocked again by referring the default document in it.

#### Security URL

By specifying a security URL the content served from this directory and its subfolders will be treated as like it comes from that URL. This is especially important for applications running in Internet Explorer where under Windows XP SP2 pages served from the local machine are prevented from running scripts. The security URL will declare them as coming from the URL specified and IE will allow their scripts to run. Recommended setting: Your site or the URL of an online page related to the application. By default ALP is configured to declare all the pages as "alp://" pages (e.g. for the IE security manager they are all ALP pages). This setting is compatible with XP SP2 and is effective if you leave empty the setting in the directory settings you create.

Under certain circumstances you may need to declare the pages as like they come from certain WEB site. For example you can fill in http://www.yoursite.com in the edit box. This would be a requirement if you want to implement cross-frame scripting in a setup where part of the frames are served by ALP and part comes from the online WEB site. In such case you should fill the Security URL for the directory(ies) containing the ALP content used with the base URL of the online WEB application. If the WEB site is secure you may need also to pay attention to the Declare content as secure option.

Potential problems you should be aware of

Using a http URL in the Security URL may cause strange behavior in some rare cases - namely if you use IFRAME or a script in the HTML code of the page and if they refer to other site(s). The problems can be caused by the IE protection features that block scripts from navigating to foreign URL, obtaining content from such URL (for instance scripts that pre-load images) and the cross-frame scripting protection mechanisms. If you have such a mixed content in some pages, fetched from various different locations, we strongly recommend you test it before distributing the application.

#### Declare content as secure and or safe

These two flags are by default not set. If declare the content from this directory as secure it will be treated by the browser as it is encrypted (it will not be actually) e.g. as if it comes through a https protocol. This may help you if your application uses mixed content (such as some images from a secure WEB site, while the main content is generated by ALP or the reverse). Note that if you declare the content secure the browser will ask the user for permission to show non-secure content each time ALP serves page that contains image or anything else that is fetched through another protocol. Declaring the content safe (trusted) has a almost no effect and is placed in this applet "just-in-case".

#### Custom 404 error page

You can specify a page that will be shown/executed whenever a file not found error occurs. I.e. if the URL points this directory or sub-directory under it and the file specified in the URL (or the default file if no file is specified in the URL) does not exist - then this page will be executed instead. This allows you intercept File Not Found errors and perform operations instead of showing a simple error message.

Sample: /errpage.asp or /subdir/subdir2/errpage.asp
The specified path is a virtual path in the Virtual ALP site. Therefore you should check where your Virtual ALP site begins in order to determine what is the correct path for this entry. If mistaken the File Not Found error will be shown and you will be able to see where ALP attempts to look for the error page and correct this setting accordingly.

#### Default documents

Default documents to be opened if the file name is not specified in the URL. Enter one file name on each line. Make sure there are no leading or trailing spaces around the file name.

#### Delete the directory settings

This will delete the directory settings specified in the directory and on of the following will apply: The defaults will be used (if no parent directory in the same site specifies some) or the settings from the closest parent directory that specifies directory settings will be used.

#### MIME type to file extension

This allows you specify a reverse map - MIME to file type. It is needed if you generate downloads with ASP pages or CGI-s. In such case ALP will need to know what file extension must be assigned to the file name suggested to the user. If the download is to be opened in an external application it is important to set the correct MIME to file extension association so that the Windows can start the correct program. In some cases different MIME types can be mapped to one file extension - for example many applications have different MIME types for different versions of their document format, but still the same file extension can be used for them all.

#### File extension

Specify the file extension in this box.

#### Mime type

Specify the MIME type in this box or use the popular applications drop down to fill-in pre-defined setting for some of the most popular applications.

#### Add the MIME types with forced download

Click this button to add entries for all the MIME types with force download set in the ALP application MIME to file extension map. This is especially useful when you have resource files that will open in external applications. Adding settings in the both maps will guarantee that they will always act correctly no matter if the Windows registry contains incorrect entries on the target machines.