note 66052 added to function.opendir
| From: | tim2005 at osu1 dot php dot net | Date: | Sat, 13 May 2006 12:04:36 +0000 |
| Subject: | note 66052 added to function.opendir | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-111213@lists.php.net to get a copy of this message | ||
Hello,
A friend of mine is running a webhost, I think i found a security leak with this script:
<?php
function select_files($dir, $label = "", $select_name, $curr_val = "",
$char_length = 30) {
$teller = 0;
if ($handle = opendir($dir)) {
$mydir = ($label != "") ? "<label
for=\"".$select_name."\">".$label."</label>\n" :
"";
$mydir .= "<select name=\"".$select_name."\">\n";
$curr_val = (isset($_REQUEST[$select_name])) ? $_REQUEST[$select_name] : $curr_val;
$mydir .= ($curr_val == "") ? " <option value=\"\"
selected>...\n" : "<option value=\"\">...\n";
while (false !== ($file = readdir($handle))) {
$files[] = $file;
}
closedir($handle);
sort($files);
foreach ($files as $val) {
if (is_file($dir.$val)) { // show only real files (ver. 1.01)
$mydir .= " <option value=\"".$val."\"";
$mydir .= ($val == $curr_val) ? " selected>" : ">";
$mydir .= (strlen($val) > $char_length) ? substr($val, 0,
$char_length)."...\n" : $val."\n";
$teller++;
}
}
$mydir .= "</select>";
}
if ($teller == 0) {
$mydir = "No files!";
} else {
return $mydir;
}
}
echo select_files("C:/winnt/", "", "", "", "60");
?>
Now i can see hist files in his windows dir. Is this a leak? and is it fixable? I'll report
this as bug too!
Tim2005
----
Server IP: 83.137.20.120
Probable Submitter: 81.70.250.37
----
X-Spam-Status: No, hits=3.3 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER,
HTML_MESSAGE autolearn=no version=2.64
----
Manual Page -- http://www.php.net/manual/en/function.opendir.php
Edit -- http://master.php.net/note/edit/66052
Del: integrated -- http://master.php.net/note/delete/66052/integrated
Del: useless -- http://master.php.net/note/delete/66052/useless
Del: bad code -- http://master.php.net/note/delete/66052/bad+code
Del: spam -- http://master.php.net/note/delete/66052/spam
Del: non-english -- http://master.php.net/note/delete/66052/non-english
Del: in docs -- http://master.php.net/note/delete/66052/in+docs
Del: other reasons-- http://master.php.net/note/delete/66052
Reject -- http://master.php.net/note/reject/66052
Search -- http://master.php.net/manage/user-notes.php