note 17978 added to security.filesystem

when using Apache you might consider a apache_lookup_uri on the path, to discover the real path, regardless of any directory trickery. then, look at the prefix, and compare with a list of allowed prefixes. for example, my source.php for my website includes: if(isset($doc)) { $apacheres = apache_lookup_uri($doc); $really = realpath($apacheres->filename); if(substr($really, 0, strlen($DOCUMENT_ROOT)) == $DOCUMENT_ROOT) { if(is_file($really)) { show_source($really); } } } hope this helps regards, KAT44 -- http://www.php.net/manual/en/security.filesystem.php http://master.php.net/manage/user-notes.php?action=edit+17978 http://master.php.net/manage/user-notes.php?action=delete+17978 http://master.php.net/manage/user-notes.php?action=reject+17978