note 68421 deleted from function.opendir by cmb

Note Submitter: Christian ---- Pointing on the previous post, I'd like to say the following. You can use opendir on all valid (existant and reachable) folders. This counts not only for windows but also for linux. Under linux, you can also read root folders etc. To avoid access to non-public data, you should check the given parameter for opendir before executing opendir. Let's say you have this: /home/users/mrsmith/ /home/users/mrsmith/info.txt /home/users/mrsmith/test/photo.jpg /home/users/mradmin/private.txt Now you don't want mrsmith to access mradmin's folders/files. In that case you could/should define the path where the data MUST be inside. Attention: Don't check the data with substr though, it's not a secure solution. Exploit example: /home/users/mrsmith/../mradmin/ Exploit example2: /home/users/mrsmith/../../../../../../../../../../../../../dev/ I'd do a case sensitive regex match. So after the first folder there may not be a subfolder named ".." because that would jump one folder back. I hope this isn't too offtopic or so but I think it's important to think of that when creating file systems.