note 66714 deleted from function.readdir by bjori

Note Submitter: Mr. Obvious Reason: integrated ---- Directed towards: lars ( at ) noname00 dot org 06-Jan-2005 11:06 Your script has a very dangerous flaw in that you are taking user input with a $_GET statement. This means that a mischievous person could access the root of your *nux box simply by adding "../../../" to the URL (assuming home/username/public_html/ directory standing). Adding something generic before your first IF statement would prevent any "../" attempts by setting the directory to the current directory. if (eregi("../",$path)) $path = ".";