Forms, stupid forms

tbone2k

Hi,

let me explain what i am trying to do:
i have the following code in file_mgr.php:

switch ($mode)
{
case 'f_edit':
include("includes/file_edit.php");
break;
case 'edit':
if (isset($file))	
{
	$res = WriteFile("$dir/$file", $theFile);
}
include("includes/file_edit.php");
break;
}

$dir contains a file url such as c:/program files/apache/...
clicking on a link somewhere on the page calls file_mgr.php?mode=f_edit&dir=c:/program files/apache group/apache/htdocs/web/files/
which changes $dir to a different value and sets $mode to 'f_edit' and executes this case.

file_edit.php contains the following form:

<form name=edit action=<?php echo "$PHP_SELF?mode=edit"; ?> method=post>

  <textarea name=theFile rows=15 cols=75 wrap=virtual><?php
	if (isset($file)){
		readfile("$dir$file");
	} ?></textarea>
<br>File name: <input type=text name=file size=25 value=<?php echo $file; ?>>
<input type=submit value="Save File">

when this form is submitted $mode is set to 'edit' and the body of the case is executed, but with the old value of $dir.
I want the case to be executed with the new value of $dir.

Why is this?

Its been bugging me all day!

PLEASE HELP

🙂

littleknife

but i haven't seen "$dir" is set in "file_edit.php"~

tbone2k

but i haven't seen "$dir" is set in "file_edit.php"~

$dir is set initially in 'file_mgr.php' and because 'file_edit.php' is included in 'file_mgr.php' :

include("includes/file_edit.php");

it has the correct variable scope to allow it to be accessed in the body of the case construct.

At least I think this is happening....

😕

Weedpacket

Could you give us an example of a link which is supposed to change the value of $dir?

Also, if you're setting the value of $dir in the script you're calling, chances seem good that what's happening is that the new value of dir is getting to your script okay, but then that setting is wiping it out and replacing it with the old one again.

One of my recommendations is to use $GET['dir'] instead of $dir to refer to the new string coming from the form. This will keep them apart. Then what you can have, instead of just setting $dir is something like

if(empty($_GET['dir']))
{ $dir = '[i]c:/program files/apache/...[/i]';
}
else
{ $dir = $_GET['dir'];
}

In the longer term, I feel obliged to point out that putting file paths and such in a URL is a huge security vulnerability, and recommend the development of some safer method that doesn't expose bits of your system's internal workings to the world.