[RESOLVED] directory location frustration

[leonv12]

I have been trying to understand and fix this for two days...

I have a php script in my hosted public_html directory. It builds a list of status informtion with links to log files (the status is ftp'd to the public_ftp directory). Here's a snipet:

        $list .= "<li><FONT COLOR=\"yellow\"><A HREF=\"displog.php?file=../public_ftp/reports/daily/logfiles/$client.$dow\">$fileName</A> is $holdStr</FONT>";

It works fine. I now need to move the php script to a subdirectory of public_html where I can easily password protect access. I assumed I could move the php file down a level and use two levels up (../../) instead of one level up (../) but I get 404 not found.

I tried anchoring back to /home, but I can't figure it out either. Can anyone please assist with this? Perhaps there is a tutorial on hosted directories..

BTW, my host company is startlogic.

Thanks in advance,
Leon

[NogDog]

You could do:

$list .= "<li><FONT COLOR=\"yellow\"><A 
href=\"displog.php?file=reports/daily/logfiles/$client.$dow\">$fileName</A> 
is $holdStr</FONT>";

Then in the displog.php file:

$file = $_SERVER['DOCUMENT_ROOT'] . '/' . $_GET['file'];

However, note that this type of thing is pretty bad from a security standpoint, as a hacker might find that he can read files you'd rather he did not by putting in a path with the right combination of ".." and directory names. Probably better would be to just pass the filename, filter it with [man]basename[/i] in the script, then hard-code the path within the script. If the files can be in more than one directory, then pass an additional parameter for that:

<a href='displog.php?file=test.log&type=daily'>Daily Report</a>

$file = basename($_GET['file']);
$type = basename($_GET['type']);
switch($type)
{
   case 'daily':
      $dir = $_SERVER['DOCUMENT_ROOT'].'/reports/daily';
      break;
   case 'weekly':
      $dir = $_SERVER['DOCUMENT_ROOT'].'/reports/weekly';
      break;
   default:
      die("Invalid report type specified");
}
if(is_readable($dir.'/'.$file))
{
   // output $dir.'/'.$file
}
else
{
   // file not found error
}

[leonv12]

Thanks NogDog! After a little more work, I figured out that the real problem was that the php file accessed another php file that was in the parent directory and not referenced to the parent directory.

Your security points are well taken, and I will be updating my code.

Thanks again,
Leon