Delete file from a list

Boxkites

Hi
I am trying to set up a system that will delete a class file that is part of a list of files from a certain folder, when clicking on an icon representing that particular file.

Please look at the list code I am using to display the list plus the icons etc.

<?php include ("header.php"); 

if ($handle = opendir('Classes/CourseFiles/')) {
while (false !== ($fileName = readdir($handle)))
{
    if ($fileName != "." && $filename != ".." && strtolower(substr($fileName, strrpos($fileName, '.') + 1)) == 'htm')
    {
        $thelist .= '<tr class="List">
<td><a href="classes/CourseFiles/' .$fileName.'"><span class="List">'.$fileName.'</span></a></td>
<td><a href="delete_class_file.php?$fileName" title="Delete ' .$fileName .'"><img src="img/delete-file-icon.png" width="64" height="64" alt="delete this file" border="0" ></a></td>
<td><img src="img/addUser.png" width="64" height="64" title="Add Students" alt="Add Students" border="0"></td>
</tr>';
        }
    }
    closedir($handle);
}

if($fileName == "." || $fileName == ".." || $fileName == "index.php" ) 
{
  continue; 
}
?>

The listing process is working ok for me so far, you are welcome to take a peek: Click here

but what would the "delete_class_file.php" look like?

I have this, what you see below, but is not working at all.

<?php 
include ('header.php');
$folder = "Classes/CourseFiles";
$fileName= $folder .$fileName;

if(@unlink($fileName))
{
   echo "
<div id='maindata_Delete'>
<div align=\"center\">File deleted [<a href='index.php'>Click Here</a>] to delete another file or [<a href='viewFiles.php'>Click Here</a>] to go back to the home page</div>";
}
else
{
   echo "
<div id='maindata_Delete'>
<div align=\"center\">File could not be deleted [<a href='viewFiles.php'>Try Again</a>]</div>";
};

include ("footer.php");
 ?>

Your help is appreciated.
Robert

Weedpacket

Items from a URL's query string are found in the [font=monospace]$_GET[/font] array.

You will of course want to check that the given filename is valid, and names a file that should be deleted.

Also, see The Spider of Doom, and §9.1.1 of the HTTP specification.

Boxkites

Thanks for your comment Weedpacket, but it still does not answer the question I posted.
"what would the "delete_class_file.php" look like?"

Is it possible for anyone to show me?

Thanks again in advance for your help.
Robert

Ashley_Sheridan

That question doesn't really make any sense. It sounds though like you're asking for someone to paste a working example of code, which ain't gonna happen.

As well as what Weedpacket advised (which you need to seriously consider or someone will abuse this code and make your day very bad indeed) I notice that you're suppressing the error from unlink() which I'm pretty sure will also suppress a false return. I wouldn't recommend ever using @ to suppress an error. You should instead test for errors with a try/catch when using functions like this.

sneakyimp

Weedpacket;11022261 wrote:
Also, see The Spider of Doom, and §9.1.1 of the HTTP specification.

Regarding the former: WTF? How does one land such a large contracting job with such little expertise? That sounds like a money-making opportunity.
Regarding the latter:

In particular, the convention has been established that the GET and HEAD methods SHOULD NOT have the significance of taking an action other than retrieval. These methods ought to be considered "safe". This allows user agents to represent other methods, such as POST, PUT and DELETE, in a special way, so that the user is made aware of the fact that a possibly unsafe action is being requested.

What an epiphany! Three cheers for clarity. My head is exploding.

sneakyimp

I think your delete class file would
before deleting anything, you should make sure a user is logged in. That was the point of Weedpacket's post.
Check $GET["fileName"] to see which file someone is trying to delete. Be very suspicious of this value because a sneaky user can specify anything the want.
Make sure $GET["fileName"] is one of the files in the directory you are actually thinking of and not some important file like /etc/passwd
Make sure the file can be deleted by using [man]is_readable[/man]
* delete the file using [man]unlink[/man]

NogDog

sneakyimp;11022405 wrote:
...
* Make sure the file can be deleted by using [man]is_readable[/man]
...

[man]is_writable/man may be more applicable. 🙂

PS: Assuming the potentially deletable files are all in the same directory, I would apply basename() to the input value to remove any use of relative or absolute directory paths. In fact I'd probably reject any value where basename($the_value) != $the_value.