need help with php

ice99 · 12-11-2005, 11:41 AM

hello.

can someone help me please? i need to make a php script to display a files on my server in browser.
i m trying a couple of days but i can't do this

let me bee more specific.

i need a form with text field and submit button, so i can enter some directory and when i click on submit button
on next page to display the contents of thet directory. for example when i enter /home in text field on next
page to see all files and folders in that directory.

i have a submit form like the one bellow:
<HTML>
<HEAD>
<TITLE>Display Directory Contents</TITLE>
</HEAD>
<BODY>

<P><strong>Enter Directory Name:</strong><br>
<INPUT type="text" NAME="directory_name" SIZE=30></P>
<P><INPUT TYPE="submit" NAME="submit" VALUE="Display"></P>
</FORM>
</BODY>
</HTML>

and :

<?

$dir_name = "/home/";

$dir = opendir($dir_name);

$file_list = "<ul>";

while ($file_name = readdir($dir)) {

if (($file_name != ".") && ($file_name != "..")) {
$file_list .= "<li>$file_name";

}
}

$file_list .= "</ul>";

closedir($dir);

?>
<HTML>
<HEAD>
<TITLE>Directory Listing</TITLE>
</HEAD>
<BODY>

<P>Files in: <? echo "$dir_name"; ?></P>

<? echo "$file_list"; ?>
</BODY>
</HTML>

the second php code is workin fine. it display all files in home directory, but i need to be able to display
directory that i want to be displayed.

example when i enter in first page /root to display all files
in /root directory, or when i enter /usr to display all files in /usr directory.

thanks in advance

wrj · 12-11-2005, 01:23 PM

How about something like this at the top of your php code:

if ($_REQUEST['directory_name']) {
$dir_name = $_REQUEST['directory_name'];
}
else {
$dir_name = "/home/";
}

... do a check to make sure $dir_name is something valid ... you should never trust user input

Hope that helps,
w

btmiller · 12-11-2005, 04:15 PM

Also, you won't be able to list the contents of /root unless it's readable by the Web server process, which it shouldn't be. PHP scripts like this that allow access to system directories can be big security holes if you're not careful, as wrj alluded to.

ice99 · 12-17-2005, 04:38 AM

ok ...thanks to all... here is the script so anyone can use it. but what i need now is this....how can i create a form with user name and password so i can login to my server and after my login to se the page with my files and folders. i know how to do this with user name and passwords stored previously in some mysql database, but i need to login with my root username and my root password. something for example when i enter root for username and my pass the script need to compare with the username and password in /etc/shadow and then if everything is ok to let me in...or something similar....

thanks in advance...again. smile.gif

<HTML>
<HEAD>
<TITLE>Display Directory Contents</TITLE>
</HEAD>
<BODY>

<form action="backend.php" method="post">
<P><strong>Enter Directory Name:</strong><br>
<INPUT type="text" NAME="directory_name" SIZE=30></P>
<P><INPUT TYPE="submit" NAME="submit" VALUE="Display"></P>
</FORM>
</BODY>
</HTML>

and

backend.php:

<?
if ($directory_name != "") {
} else {
$directory_name = ( isset($HTTP_GET_VARS['directory_name']) ) ? $HTTP_GET_VARS['directory_name'] : $HTTP_POST_VARS['directory_name'];
$directory_name = htmlspecialchars($directory_name);
}

$list = split("\n",`ls $directory_name`);

$pattern = "/[dwrx\-]{10}/";

foreach($list as $file)
{
$file = preg_split("/ /",$file,20,PREG_SPLIT_NO_EMPTY);
echo "<a href='backend.php?directory_name=$directory_name/";
echo join("|",$file) ."'>\n";
echo join("|",$file) ."<br>\n";
print "</a>";
//echo "$directory_name";
//echo "$file[0]\n";
}
?>