note 89480 added to security.filesystem

A basic filename/directory/symlink checking may be done (and I personally do) via realpath() ... <?php if (isset($_GET['file'])) { $base = '/home/polizei/public_html/'; // it seems this one is good to be realpath too.. meaning not a symlinked path.. if (strpos($file = realpath($base.$_GET['file']), $base) === 0 && is_file($file)) { unlink($file); } else { die('blah!'); } } ---- Server IP: 209.41.74.194 Probable Submitter: 78.142.42.38 ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- https://master.php.net/note/edit/89480 Del: integrated -- https://master.php.net/note/delete/89480/integrated Del: useless -- https://master.php.net/note/delete/89480/useless Del: bad code -- https://master.php.net/note/delete/89480/bad+code Del: spam -- https://master.php.net/note/delete/89480/spam Del: non-english -- https://master.php.net/note/delete/89480/non-english Del: in docs -- https://master.php.net/note/delete/89480/in+docs Del: other reasons-- https://master.php.net/note/delete/89480 Reject -- https://master.php.net/note/reject/89480 Search -- https://master.php.net/manage/user-notes.php