Home/ Questions/Q 6386117
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T02:59:02+00:00

Ok I get a script from: http://abeautifulsite.net/blog/2008/03/jquery-file-tree/ Its a directory listing script. I am

  • 0

Ok I get a script from: http://abeautifulsite.net/blog/2008/03/jquery-file-tree/

Its a directory listing script. I am having troubles with it. It works out of the box no problems per say other than the put fact that it goes way back into the system structure then I am allowed to even see some how.

The person that made the script has this one line that throws me off and I can’t make heads of tales of it per say.

file_exists($root . $_POST['dir'])

I’ve never seen $root in that context before. Nor is it defined anywhere in the script from what I can tell. So is that a valid thing? If not can anyone tell me how I can use this script beneficially to just displaying directories starting at a specific directory. The document I point to with the above link shows an example, but it doesn’t seem to mean anything to the scripts workings.

On the other hand if someone knows of a canned script thats very similar in nature I’d be happy to give that a look too. But I’d really like to edit this one to work the way I want it to work so any help would be appreciated.

an example of how far its going back can be found at http://domainsvault.com/tree/
I say its going far back because I don’t even have access to those directories through my http://ftp.. its a shared system.. hostgator..

*EDIT* Thanks Everyone for the input, this essentially what I was afraid of hearing. It was hopped that we could skip reinventing the wheel by using this concept. But its appearing more so than not that its basically a bricked concept and far from worth using and attempting to tamper with. It’d likely be a lot more easy for me to build something from scratch than have to deal with this. This was just one of those canned scripts you find it looks ascetically pleasing to the eye, and you hope for the best. Didn’t turn out to be the case, thanks again all.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team
    file_exists($root . $_POST['dir'])

    Run away.

    This connector script does no checking on what paths you pass to it, so it’s perfectly possible to escape the root (which, yes, you’re supposed to set manually) and browse any files on your server that the web user has access to.

    Also, it fails to do URL-escaping, and mangles Unicode through inadvisable use of htmlentities. This will make files with various punctuation or non-ASCII characters in fail.

    This is a shonky and insecure script. Do not deploy it.

    • 0