note 63969 deleted from function.readdir by bjori
| From: | bjori@php.net | Date: | Tue, 04 Apr 2006 19:23:49 +0000 |
| Subject: | note 63969 deleted from function.readdir by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-107332@lists.php.net to get a copy of this message | ||
Note Submitter: concerned
Reason: bad code
----
I was looking at some of the nice scripts here and noticed
that nothing really would stop a person from looking at a
directory above your base path.
for example if your base path was
c:\\inetpub\\mydomain\\download
you could view above it using \\..\\..\\.. or even just \\ for
the root
the following code would be a good start at parsing the
passed pathname for potential problems.
if (stristr($path,"..") || $path == "\\\\" )
{
print "!!! SECURITY PROBLEM <BR><BR>";
}
hope this helps