[RESOLVED] Changing a variable when a link is clicked

Skawn

This is almost certainly ludicrously simple!

Heres a bit of code that gets the contents of a directory and lists it as links to the filename:

<?php

$path = "h:\media";
$dh = opendir($path);
$i=1;
while (($file = readdir($dh)) !== false) {
    if($file != "." && $file != "..") {
        echo "$i. <a href='$file'>$file</a><br />";
        $i++;
    }
}
closedir($dh);
?>

What I want to do is have it so that clicking a link, instead of trying to open the file, reloads the page with $file as the new value of $path so that it can navigate directory structure except when $file isn't a directory, in which case I want it to open the file.

Any help would be appreciated!

bradgrafelman

Sounds easy enough, just a couple of modifications to do.

Change your path to use forward slashes - otherwise, you have to consider escaping the backslash and whatnot. Also, add an ending slash (e.g. "H:/media/"). We'll be adding relative paths on to the end of this path - you'll see.
Add something like this after your $path statement:
```
$user_path = (isset($_GET['p']) ? str_replace('../', '', $_GET['p']) . '/' : '');
```
It'll become clear where this data comes from, but for now I'll just point out the fact that we're stripping out '../' so that they can't maliciously access a different directory outside of the base directory you define.
Change your link to look like:
```
echo "$i. <a href='myscript.php?p=" . urlencode($user_path) . '/' . urlencode($file) . "'>$file</a><br />";
```
Now you should see where that "p" element above comes from - we're redirecting all links back to your script so it can perform the appropriate action. Speaking of the "appropriate action"...

Above your $dh line and while() loop, add something like this:

if(is_file($path . $user_path)) {
    $filename = basename($user_path);
    header ('Content-Type: application/octet-stream');
    header ('Content-Length: ' . filesize($path.$user_path));
    header ("Content-Disposition: attachment; filename=\"$filename\"");

$filepath = $path . rtrim($user_path, '/');

$fp = @fopen($filepath,'rb') or die("Couldn't open file: " . $filepath);
while(!feof($fp))
	echo fgets($fp, 4096);
fclose($fp);
exit;
}

Pretty straightforward.. outputs headers to make the browser download the file. Notice I used [man]rtrim/man to strip off any ending slashes in the user path (since an ending slash is automatically added in the $user_path declaration above.

Okay, so if it's not a file, it must be another directory! To get the script to read the new directory, change your opendir() line to this:
```
$dh = opendir($path.$user_path);
```

Let me know if there's anything you don't understand.

Skawn

Thats superb, works perfectly - thanks very much.

Not sure if I'm understanding why though! Hows this?

The first block is setting the $user_path variable as whatever follows the p= in the url. Where is that file variable coming from though?

The second block is creating the link, what does urlencode do that just putting the variable in not? I tried taking it out and everything still seems to work OK but I assume it's good practice to use it?

The bottom part of the third block (from where the $filepath variable is set) I don't get at all - removing it doesn't seem to stop anything from working - what does it do?

bradgrafelman

Skawn wrote:
Where is that file variable coming from though?

It comes from the link they click. If you'll notice, the links are prepended with the current value of $user_path, so that as you get several directories deep, the $user_path is a path relative to the root of the directory you initially scanned.

Skawn wrote:
what does urlencode do that just putting the variable in not?

As you'll note on the manual page for [man]urlencode/man, this function converts non-alphanumeric characters into the URL-safe %xx equivalent. Not only does this keep your URLs from containing spaces and such, it also helps prevent directories with single quotes in them from breaking your HTML.

Skawn wrote:
The bottom part of the third block (from where the $filepath variable is set) I don't get at all - removing it doesn't seem to stop anything from working - what does it do?

Are you referring to the fopen()/fgets() section? If so, this is the part of the code that outputs the file to the browser.

Skawn

bradgrafelman wrote:
It comes from the link they click. If you'll notice, the links are prepended with the current value of $user_path, so that as you get several directories deep, the $user_path is a path relative to the root of the directory you initially scanned.

I'd just noticed that was a silly question and editing that out when you replied! I was so busy looking at the new code, I'd forgotten that $file was declared in the original!

bradgrafelman wrote:
As you'll note on the manual page for [man]urlencode/man, this function converts non-alphanumeric characters into the URL-safe %xx equivalent. Not only does this keep your URLs from containing spaces and such, it also helps prevent directories with single quotes in them from breaking your HTML.

Cool, that makes sense.

bradgrafelman wrote:
Are you referring to the fopen()/fgets() section? If so, this is the part of the code that outputs the file to the browser.

I must have not tried opening anything after removing that bit, will go check out the relevent bits of the manual.

Thanks very much for the help.