note 33806 rejected from security.filesystem by didou
| From: | didou@php.net | Date: | Tue, 08 Jul 2003 12:51:27 +0000 |
| Subject: | note 33806 rejected from security.filesystem by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-51695@lists.php.net to get a copy of this message | ||
Note Submitter: r.hawke@web.de
----
I like to use realpath() to check where the user is.
If realpath doesn't start with /home/username/ anymore then i just abort the script
user_dir = "/home/" . $username
$rp = realpath($user_dir)
$rp_substr = substr($rp,0,strlen($user_dir))
if($rp_substr != $user_dir) {
exit;
}
This has up till now worked well for me. If anyone sees a security leak please tell me!