note 66714 added to function.readdir

Directed towards: lars ( at ) noname00 dot org 06-Jan-2005 11:06 Your script has a very dangerous flaw in that you are taking user input with a $_GET statement. This means that a mischievous person could access the root of your *nux box simply by adding "../../../" to the URL (assuming home/username/public_html/ directory standing). Adding something generic before your first IF statement would prevent any "../" attempts by setting the directory to the current directory. if (eregi("../",$path)) $path = "."; ---- Server IP: 216.194.113.175 Probable Submitter: 72.129.201.37 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.readdir.php Edit -- http://master.php.net/note/edit/66714 Del: integrated -- http://master.php.net/note/delete/66714/integrated Del: useless -- http://master.php.net/note/delete/66714/useless Del: bad code -- http://master.php.net/note/delete/66714/bad+code Del: spam -- http://master.php.net/note/delete/66714/spam Del: non-english -- http://master.php.net/note/delete/66714/non-english Del: in docs -- http://master.php.net/note/delete/66714/in+docs Del: other reasons-- http://master.php.net/note/delete/66714 Reject -- http://master.php.net/note/reject/66714 Search -- http://master.php.net/manage/user-notes.php