using popen to list a directory (server config?)

schuss

i have a script that worked previously, and after a server migration is suddenly broken. it looks like this:

$fp2 = popen( "ls photos/$subdir 2>&1", "r" );

		while ($pfile = fgets($fp2, 60))
		{

                  // do stuff to each file

		}

the goal is to scan a directory for photos, make/identify thumbnails, and auto-build a gallery page.

like i said, it worked until my server move and now popen returns a list of nothing. with the error reporting on (as above) i get "Resource id #7; resource" as the only output.

i've checked that all dir's and files are 755, anything else i could think of.

any suggestions on what configuration might prevent this sort of access to the filesystem? my webhost is willing to check the httpd.conf for me if i tell them what i'm looking for (no guarantee they'll change it, tho).

PHP v 4.3.2
FreeBSD 4.8
Apache 1.3.27

schuss

doing some more searching and research, may have answered my own question.

i think the problem is that "ls" is not included in the directory provided by safe_mode_exec_dir. safe mode is on (a good thing) but apparently my webhost thinks "ls" is dangerous and scary and they excluded it.

if i'm right (i've asked them to check the httpd.conf and the contents of the appropriate directory) then at least i know what the problem is... working around it will be another story.

schuss

i tried used "dir" instead of "ls" - apparently that's bad-news, too

exec and shell_exec are limited by the same roadblock.

i'm thinking it could also be an apache configuration that prevents directory listing. i know the site is set up that web visitors can't hit "http://site/subdirectory/" if there is no index file - they get a directory listing permission denied error. maybe that same security scheme applies to scripts?

is there anyone who has a server with similar security levels and found a workaround in php without compromising security??