note 86384 added to function.realpath

In response to the code from waldemar dot axdorph at gmail dot com Going solely based on the number of slashes is only slightly better than doing no checks at all. That won't catch something like this, which is just as much a problem: <?php above_dir('../../../home/joe/.ssh/', '/var/www/filemgr') ?> An easier (and more secure) way of accomplishing that is: <?php function isAboveBasePath( $path, $base ) { $path = realpath( $path ); $base = realpath( $base ); return 0 !== strncmp( $path, $base, strlen( $base ) ); } ?> Makes sure that the real search path matches 100% the real base path, up to the length of the base path. $path should always be longer than $base, which is fine as long as $path starts with the same string as $base. Also note that if you have any symlinks in the $base dir that point outside of $base, this check will fail ... but that's a very rare case, and is still at least over-protective, rather than insecure. ---- Server IP: 69.147.83.197 Probable Submitter: 71.225.63.221 ---- Manual Page -- http://www.php.net/manual/en/function.realpath.php Edit -- https://master.php.net/note/edit/86384 Del: integrated -- https://master.php.net/note/delete/86384/integrated Del: useless -- https://master.php.net/note/delete/86384/useless Del: bad code -- https://master.php.net/note/delete/86384/bad+code Del: spam -- https://master.php.net/note/delete/86384/spam Del: non-english -- https://master.php.net/note/delete/86384/non-english Del: in docs -- https://master.php.net/note/delete/86384/in+docs Del: other reasons-- https://master.php.net/note/delete/86384 Reject -- https://master.php.net/note/reject/86384 Search -- https://master.php.net/manage/user-notes.php