deny access on apache 2.0

felipe_lopes

Hi guys!

My problem is that, when I use the readdir() function like this

=========

$handle = "/";

while (false !== ($file = readdir($handle))) {
echo "$file\n";
}

=========

It displays all files of my "c:" drive!!! I mean, it should stop reading directories at server root, right!?!

So I'm quite sure that it is something to do with my apache config file....Anyone knows what should I do?

Thanks in advance...

Mordecai

Well, you should be getting an error like this:
Warning: readdir(): supplied argument is not a valid Directory resource...

However, if you attempt to read "/," it will read your C: drive. This happens naturally on Apache. Try something like this:
$handle = $_SERVER["DOCUMENT_ROOT"]."/";
$handle = opendir($handle);
while ($file = readdir($handle)) {
echo($file."<br>\n");
}
closedir($handle);

Also, your code seems to run pretty slow, try rewriting it the method that I just showed.

felipe_lopes

Hi Mordecai!

Thank you for your help!

To read my root directory I use "./" which works fine...But, on my script, the path can be defined thru a GET variable, so what can happen is people type "?dir=/" on the url, what will display my "c:" drive to them....

What I really want is a way to config my apache to avoid this kind of thing..

Can u help me?

Thank you again

Mordecai

./ actually just means "current directory." (Or is it a cyclops smily face?)

I don't think there's a way to tell it that it can't read the C: drive.
If you do something like this: $_SERVER["DOCUMENT_ROOT"].$url, it will read from your document root and up. But they can still do ".." as the URL and go down to your C: drive.

felipe_lopes

U might be right.

But I will make a search on this subject to make sure :-)

Thank you