Question

I have a php script in a folder (I call it the root folder). The script can basically list all files in subfolders of this root folder. The user can specify which subfolder should be displayed by using GET-parameters.

script.php?foo

would display the content of

<root folder>/foo/

and
script.php?.bar
would display the content of

<root folder>/.bar/

However, users could also “cheat” and use commands like /.. to display the content of folders they souldn’t be able to see.

For example with

script.php?/../..

the users could get very high in the folder hierarchy.

Do you have an idea how to prevent users of doing “cheats” like this.

For reason of simplicity, let’s say the GET-parameter is stored in $searchStatement.

Answer 1

You could use realpath to resolve the relative path to an absolute one and then check if that path begins with your “root” folder’s path:

$absolutePath = realpath(__DIR__ . '/' . trim($searchStatement, '/'));

if (strpos($absolutePath, __DIR__ .'/') !== 0) {
    die('Access denied.');
}