note 36027 deleted from function.show-source by aidan
| From: | aidan@php.net | Date: | Sun, 26 Sep 2004 14:10:52 +0000 |
| Subject: | note 36027 deleted from function.show-source by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-77395@lists.php.net to get a copy of this message | ||
Note Submitter: wynder at warcry dot com
----
For security, a great function to use in conjunction with this is basename():
<?php
if ( !empty($_SERVER['argv'][0]) )
{
$f_source = basename($_SERVER['argv'][0], ".inc");
}
else
{
$f_source = "http://".$_SERVER['SERVER_ADDR'].$_SERVER['PHP_SELF'];
}
?>
The url would be: http://localhost/source.php?file.php
If someone tried to play with the query string and did:
http://localhost/source.php?/var/passwd
basename() would chop the argument down to 'passwd' and, in essense, limiting access to
files in the same directory as your source.php file. The optional argument ".inc" allows
you to exclude a single file type -- I think that could've been done a bit better, but
that's my opinion. :)