note 89480 modified in security.filesystem by danbrown
| From: | danbrown@php.net | Date: | Tue, 10 Mar 2009 13:38:27 +0000 |
| Subject: | note 89480 modified in security.filesystem by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-151686@lists.php.net to get a copy of this message | ||
A basic filename/directory/symlink checking may be done (and I personally do) via realpath() ...
<?php
if (isset($_GET['file'])) {
$base = '/home/polizei/public_html/'; // it seems this one is good to be realpath too..
meaning not a symlinked path..
if (strpos($file = realpath($base.$_GET['file']), $base) === 0 && is_file($file))
{
unlink($file);
} else {
die('blah!');
}
}
?>
--was--
A basic filename/directory/symlink checking may be done (and I personally do) via realpath() ...
<?php
if (isset($_GET['file'])) {
$base = '/home/polizei/public_html/'; // it seems this one is good to be realpath too..
meaning not a symlinked path..
if (strpos($file = realpath($base.$_GET['file']), $base) === 0 && is_file($file))
{
unlink($file);
} else {
die('blah!');
}
}
http://php.net/manual/en/security.filesystem.php