First off let me explain a bit about what this script does. I've got a website that has a database of 60,000 files in 7,000 folders. I need to find a way to have users safely navigate through these folders WITHOUT sending them to the actual files. I've come up with a way to list the folders and correctly set the session to know which folders to be navigating.
My problems are as follows:
1. Alphabetical order... NO clue why the script reads in random order, is there something I can do to fix this?
2. Tables... how would I export the data into a two column table?
3. Second level navigation. After the first folder is chosen, I'm having trouble getting the script to read WHERE to send the second folder choice.
4. Files:
.... a. After my users choose the first folder, then the second folder, they will see a list of files. Instead of linking directly to these files, I want to link them to a page which KNOWS what the file's URL is, but its not a direct download link (download.php?fold=a&art=andrew&file=Some File.ini)
5. As it is, and depending which category the user chooses... its listing up to 500-700 folders... how would I change this so it lists approx 20 at a time then shows all the different page URL's? (Page Number: 1, 2, 3, 4, ect...)
6. How do I prevent Directory Transversal attacks with this script? Playing around I realized I could fool with the URL and ../../../ so I need to know how to secure this script as I have a LARGE amount of sensitive data on my servers... i have 18 domains, all of which are full production websites.
I've gotten the script to work SOMEWHAT so far... but I'm having trouble working those few bugs out. Any assistance at all will be greatly appreciated... even just a nudge in the right direction will help me out quite a bit.
Heres the code:
php
<?php
if (isset($_GET['fold'])) {
$fold = $_GET['fold'] . "/";
$ufold = $_GET['fold'];
} else {
$fold = "";
}
if (isset($_GET['art'])) {
$art = $_GET['art'] . "/";
$uart = $_GET['art'];
} else {
$art = "";
}
function check() {
if (isset($_GET['fold'])) {
first();
} else {
if (isset($_GET['art'])) {
second();
} else {
if (isset($_GET['download'])) {
download();
}
}
}
}
check();
function first(){
$dir = "/path/to/tabs/$fold$art";
if ($handle = opendir($dir)) {
while (false !== ($file = readdir($handle))) {
if (fnmatch(".", $file)) {
echo '';
}
elseif (fnmatch("..", $file)) {
echo '';
}
else {
if (fnmatch("*", $file)) {
echo '> <a href="browse.php?fold='.$file.'">'.$file.'</a><br>';
}
}
}
closedir($handle);
}
}
function second(){
$dir = "/path/to/tabs/$fold$art";
if ($handle = opendir($dir)) {
while (false !== ($file = readdir($handle))) {
if (fnmatch(".", $file)) {
echo '';
}
elseif (fnmatch("..", $file)) {
echo '';
}
else {
if (fnmatch("*", $file)) {
echo '> <a href="browse.php?fold='.$ufold.'&art='.$file.'&download=yes">'.$file.'</a><br>';
}
}
}
closedir($handle);
}
}
function download() {
$test = "not done yet";
}
?>
Good luck!
EDIT # 1
I think I've found a way to bypass my problems...
If I send the user to a second page, rather than checking all the variables and choosing which function to use... I can bypass the check(); function all together.
I'm going to test that and see how it works... but in any event, I STILL need to know why this script isn't working as it should be.
Thanks in advance!
EDIT # 2
About the Directory Transveral... this script uses the opendir() function, and I'm not sure if that is vulnerable? Yes, you can see the FILES that are in the directories... but you can't EXECUTE or OPEN these files due to the command in the pagination URL not being fopen();
CODE
Warning: opendir(/path/to/tabs/../../include/constants.php/) [function.opendir]: failed to open dir: Not a directory in /path/to/browse.php on line 11
am I correct with this?
This post has been edited by pr4y: 11 Oct, 2008 - 01:07 AM
11 Oct, 2008 - 12:29 AM
| 