RE: [PHP] slight quik question
| From: | Don Read | Date: | Mon, 07 Apr 2003 10:41:48 +0000 |
| Subject: | RE: [PHP] slight quik question | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-142676@lists.php.net to get a copy of this message | ||
On 07-Apr-2003 Dan Rossi wrote:
> i guess i could chroot it ?, i'ver had a similar story when doing a file
> diretory viewer and giving the dir in the query string, i managed to
> chroot
> it to a top directory only, was scary u could go all the way to /
>
$fname= urldecode($fname);
$fname= str_replace('../', '', $fname); // fix the dodgy stuff
$fname= trim($fname);
if (! ($allowpath) )
$fname= basename($fname);
$path= $imgdir .'/' .$fname;
Regards,
--
Don Read dread@texas.net
-- It's always darkest before the dawn. So if you are going to
steal the neighbor's newspaper, that's the time to do it.