note 68421 added to function.opendir

Pointing on the previous post, I'd like to say the following. You can use opendir on all valid (existant and reachable) folders. This counts not only for windows but also for linux. Under linux, you can also read root folders etc. To avoid access to non-public data, you should check the given parameter for opendir before executing opendir. Let's say you have this: /home/users/mrsmith/ /home/users/mrsmith/info.txt /home/users/mrsmith/test/photo.jpg /home/users/mradmin/private.txt Now you don't want mrsmith to access mradmin's folders/files. In that case you could/should define the path where the data MUST be inside. Attention: Don't check the data with substr though, it's not a secure solution. Exploit example: /home/users/mrsmith/../mradmin/ Exploit example2: /home/users/mrsmith/../../../../../../../../../../../../../dev/ I'd do a case sensitive regex match. So after the first folder there may not be a subfolder named ".." because that would jump one folder back. I hope this isn't too offtopic or so but I think it's important to think of that when creating file systems. ---- Server IP: 217.160.72.57 Probable Submitter: 80.140.100.181 (proxied: unknown) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.opendir.php Edit -- http://master.php.net/note/edit/68421 Del: integrated -- http://master.php.net/note/delete/68421/integrated Del: useless -- http://master.php.net/note/delete/68421/useless Del: bad code -- http://master.php.net/note/delete/68421/bad+code Del: spam -- http://master.php.net/note/delete/68421/spam Del: non-english -- http://master.php.net/note/delete/68421/non-english Del: in docs -- http://master.php.net/note/delete/68421/in+docs Del: other reasons-- http://master.php.net/note/delete/68421 Reject -- http://master.php.net/note/reject/68421 Search -- http://master.php.net/manage/user-notes.php