RE: [PHP] slight quik question

i guess i could chroot it ?, i'ver had a similar story when doing a file diretory viewer and giving the dir in the query string, i managed to chroot it to a top directory only, was scary u could go all the way to / -----Original Message----- From: Leif K-Brooks [mailto:eurleif@buyer-brokerage.com] Sent: Monday, April 07, 2003 6:00 PM To: Martin Towell Cc: 'daniel'; php-general@lists.php.net Subject: Re: [PHP] slight quik question Be careful with that, a hacker could use it to gain access to sensitve files. Feeding it a name like "../foo/bar", for example, would provide access to path/to/foo/bar. Martin Towell wrote: >something like: > >URL: http://site.com/get_image.php?name=image_name_here.jpg > >SRC: ><? >if (file_exists("path/to/file/$name")) > passthru("path/to/file/$name"); >else > passthru("path/to/file/nofile_image.gif"); >?> > >(you'll need to check the spelling of passthru... maybe it's readfile() - or >something...) > >-----Original Message----- >From: daniel [mailto:daniel@electroteque.org] >Sent: Monday, April 07, 2003 12:00 PM >To: php-general@lists.php.net >Subject: [PHP] slight quik question > > >hi guys i have been working on a photo gallery script for some time now , i >have some issues i may need help with , i have public and private galleries >i >am setting up , although the images are stored in the document directory and > >would still be viewable by accessing them directly instead of the gallery >script , how would it be possible to store the images outside the web path >and >be viewable in the page without having to use gd to do it ? > > > > > -- The above message is encrypted with double rot13 encoding. Any unauthorized attempt to decrypt it will be prosecuted to the full extent of the law. -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php