CODEWITHSUNDEEP
phpsearchdirectory-traversal
Dan Kanze
Dan Kanze

Reputation: 18595

PHP: Search Directory Tree for File and Return File Path

Consider this workflow:

User makes a request to website.com/lolmyblogpost

My .htacces is all like...

RewriteCond %{REQUEST_URI} !=/index.php
RewriteRule .* /index.php

Where in index.php im going to search a file tree of templates for lolmyblogpost.html returning:

/path/to/lolmyblogpost.html

So in my master template I can:

{include file="{$pathToTemplate}"}

How do I search a directory tree for a file and return the file path?

Upvotes: 0

Views: 382

Answers (1)

Tigger
Tigger

Reputation: 9130

What you really want is "look back" support with a default type. Set up your Apache virtual host (something) like this:

<VirtualHost *:80>
    ServerName  example.com:80
    ServerAlias www.example.com
    DocumentRoot    "/path/to/root/dir"
    AddDefaultCharset UTF-8
    ErrorDocument 403 "/403.php"
    ErrorDocument 404 "/404.php"
    <Directory /path/to/root/dir>
            Options Indexes FollowSymLinks
            DefaultType application/x-httpd-php
            AllowOverride All
            Order deny,allow
            Allow from all
            AddOutputFilterByType DEFLATE application/javascript text/css text/html text/plain text/xml
            RewriteEngine On
            RewriteBase /
            RewriteCond %{REQUEST_FILENAME} !.index.ph.*
            RewriteRule ^(.*)$  /index.php
    </Directory>
</VirtualHost>

The important line is DefaultType application/x-httpd-php, which means you can now get rid of the .php file extension.

You can now use a URL like http://example.com/this_is_a_php_page and you can also use http://example.com/this_is_a_php_page/with_a_path_info_var.

So, on this_is_a_php_page (which is really a .php file without an extension) you can use $_SERVER['PATH_INFO'] to check for and vars that are being passed in the URI.

Edit: Added the RewriteEngine and rule to push everything to index.php. This means you now have a (real) single page on the server called index.php which will need to check the $_SERVER['REDIRECT_URL'] var for what was really requested.

For example, a request for http://example.com/a_page will now load index.php with a_page passed to $_SERVER['REDIRECT_URL']. NOTE: this solution will push everything to index.php. You will need to include an exception like: 

 RewriteCond %{REQUEST_FILENAME} !.not_me_plz.*

To allow all files that start with not_me_plz files to be served "as expected".

Upvotes: 1

Related Questions