Fork me on GitHub

php coding question  Bottom

  • Greetings,
    I have two PHP files, lets call them File A and File B.

    In file A, I create a page with href links. The relevant code is:
    { print "$file
    \n"; }

    In File B I try to open myval as a directory and read it. The
    relevant code is:
    $handle=opendir($myval);
    while ($file = readdir($handle)) {
    if ($file == "." || $file == ".." || $file == "listit.php")
    { }
    else
    { print "$file
    \n"; }

    }
    closedir($handle);

    when I access File A, it generates the hrefs ok. When I click on a link,
    File B generates a unknow directory error. I have checked in File B and myval is set to the correct value. If I manually replace the $myval in the opendir statement to "0304" (or any valid directory) it works fine.

    Any ideas why it won't accept the passed in directory name ?

    thanks,
    -D
  • Try

    Code

    opendir($_GET['myval'])


    Greetings
    -->R
  • rgasch

    Try

    Code

    opendir($_GET['myval'])


    I wouldn't recommend this as a general approach - think about what values myval could have and then think directory traversal. e.g. myfile.php?myval=/etc/passwd or myfile.php?myval=../.../ etc.

    In a postnuke environment clean the variable using pnVarCleanFromInput i.e. $myval = pnVarCleanFromInput('myval').

    -Mark

    --
    Visit My homepage and Zikula themes.
  • Hi Mark,

    while you're undoubtedly correct in warning against getting such passed values directly, what would the effect of pnVarCleanFromInput() in this case be? It would still pass back a cleaned up version of the parameter it was passed and you'd still have to depend on the application to ensure that you're not including some inappropriate file.

    Or am I missing something here?

    Greetings/Thanks
    --> R
  • Robert,

    of course - my explaination only covered 50% of the issue (and missed the more vital part....).....

    pnVarCleanFromInput will deal with bad tags in content. Directory traversals should be dealt with in pnVarPrepForOS which ensures than notation like ../../ can't be used.

    So in the example you used,

    $mydir = pnVarCleanFromInput('mydir');
    if (is_dir(pnVarprepForOS($mydir)) {
    $handle = opendir(pnVarPrepForOS($mydir));
    .....
    }

    -Mark

    --
    Visit My homepage and Zikula themes.
  • Thanks for confirming my thoughts on this ...

    Greetings
    -->R
  • Is there a limit to the number of characters myval can hold ?
    My solution works for some directories, but others where the filename.gif
    is a little longer, only shows broken images.

    The only thing different in directories is the length of the file name which
    would be displayed on a page with:

This list is based on users active over the last 60 minutes.