note 86384 deleted from function.realpath by danbrown

Note Submitter: jhansche at myyearbook dot com ---- In response to the code from waldemar dot axdorph at gmail dot com Going solely based on the number of slashes is only slightly better than doing no checks at all. That won't catch something like this, which is just as much a problem: <?php above_dir('../../../home/joe/.ssh/', '/var/www/filemgr') ?> An easier (and more secure) way of accomplishing that is: <?php function isAboveBasePath( $path, $base ) { $path = realpath( $path ); $base = realpath( $base ); return 0 !== strncmp( $path, $base, strlen( $base ) ); } ?> Makes sure that the real search path matches 100% the real base path, up to the length of the base path. $path should always be longer than $base, which is fine as long as $path starts with the same string as $base. Also note that if you have any symlinks in the $base dir that point outside of $base, this check will fail ... but that's a very rare case, and is still at least over-protective, rather than insecure.