file and directory functions

[dsdjnpfvf]

Hi,

I'm new to php although I have quite advanced programming experience, so I'm learning quickly.

I've decided to try and write a sort of enhanced Directory Listing "index of" script, but I'm having a couple of problems.

I can get it working, but it's got a few bugs, and is very insecure.

For example, someone could easily type in the following line to view the content of my /etc folder into a browser:

http://server/index.php?path=/../../../etc/

Also, there's another couple of problems. If someone was to type in:

http://server/index.php?path=/////documents/

it would display the documents folder (as PHP accepts this as a valid path), but the title of my page ("index of ...."), and all the links would also contain all the extra slashes.

My last problem is that when people follow the ".." folder to move to the parent directory, my path ends up being in this form:

/child_dir/../ and not /parent_dir/

which looks a little strange.

If anyone knows of any example code I could look at that would be great. I'm sure this has been done quite a lot before.

Many thanks,

Daniel Briley

 

[KarveR]

I'd suggest inthe name of security to use POST instead of GET for passing the directory name, also see glob() and readdir()

______________________________________________________________________
There's no present like the time, they say. - Henry's Cat.

 

[blackp]

glob and readdr are great, and should solve most of your problems.

As far as the security of seeing anything on your filesystem, either be very restrictive on the user permissions, or specifically check if they are attempting to access a directory outside your specified directory.

For example, having php go to the directory and then see if the resultant directory is outside the allowed area. for example, you can declare your share as /myshare/share, then compare the beginning of any resultant directory to make certain it has /myshare/share at the beginning.

Hope this helps.

 

[dsdjnpfvf]

Thanks for the useful tips, i'll take a look at everything you suggested.

blackp: I thought about that, only problem is someone could use the following path:

/myshare/share/some_dir/../../../../etc/

which still has /myshare/share at the front, but accesses and insecure directory. I'll try and use the idea of changing to the specified directory and checking it.

Thanks again guys,

Daniel Briley

 

[skiflyer]

realpath() will address some of your issues... the ones about resolving the . and .. and //'s

http://www.php.net/manual/en/function.realpath.php

 

[dsdjnpfvf]

Thanks skiflyer