Overview

This article describes the process to follow in case the below error message is displayed when accessing certain URLs that include the '+' characters, e.g. http://www.mywebsite.com/download/text+text.

Information

Environment

• GFI WebMonitor
• All supported environments

Root Cause

This error is caused by the unencoded '+' character in the URL because by default IIS (Internet Information Services) is configured to reject this for security reasons. The GFI WebMonitor user interface is running on IIS Express, so this configuration setting also affects it.

Process

Please follow the steps outlined in the first solution and if these do not work follow the steps outlined in the second solution.

Solution 1

1. Stop the following services:
   • GFI WebMonitor
   • GFI WebMonitor Core Service
   • GFI Proxy (Standalone Proxy version only)
   • Microsoft Firewall (Microsoft ISA only)
   • Microsoft Forefront TMG Firewall (Microsoft Forefront TMG only)
2. Make a backup of \WebMonitor\Web\UI\web.config.
3. Open Web.config with a text editor.
4. Search for the <system.webServer> node and add the following code before the closing tag: 

   <security>
   <requestFiltering allowDoubleEscaping="true" />
   </security>

   This will look like the following where ... is code that is already present:

   <system.webServer>
   ...
   <security>
   <requestFiltering allowDoubleEscaping="true" />
   </security>
   </system.webServer>
   

5. Start the services stopped in step 1.

Note: Making this change may make you more vulnerable to malicious URLs.

Solution 2

Alternatively, the Download Status page can be disabled for this file type.

1. Open the GFI WebMonitor configuration.
2. Go to Settings > Policies > Security Policies.
3. Click on the policy name.
4. Find the necessary file type and deselect the progress bar next to it.
5. Save the changes.

This way, the file will be scanned by the antivirus engines but the user will see the usual download from the browser.