CODEWITHSUNDEEP
phplinuxapachefilesystemsdebian
Lynob
Lynob

Reputation: 5327

Accessing files outside the root directing

My client asked me to do a website where a user can enter a path on the machine, PHP should scan the path and load all the media files in the directory and subdirectories. The user can enter any path, Desktop, or external drives, whatever, outside the root directory. That's what the client wants and he's running on Linux.

I told him php can't access files outside the root, he said yes it can, he said I should use some proxy and he sent me this script

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>

<?PHP
session_start();
function getFileList($dir)
  {
    // array to hold return value
    $retval = array();

    // add trailing slash if missing
    if(substr($dir, -1) != "/") $dir .= "/";

    // open pointer to directory and read list of files
    $d = @dir($dir) or die("getFileList: Failed opening directory $dir for reading");
    while(false !== ($entry = $d->read())) {
      // skip hidden files
      if($entry[0] == ".") continue;
      if(is_dir("$dir$entry")) {
        $retval[] = array(
          "name" => "$entry/"
        );
      } elseif(is_readable("$dir$entry")) {
        $retval[] = array(
          "name" => "$entry"
        );
      }
    }
    $d->close();

    return $retval;
  }
$dirlist = getFileList("F:\uni\M2\Thesis\hmayed\ali\songs wav");

  // output file list in HTML TABLE format
  echo "<table border=\"1\">\n";
  echo "<thead>\n";
  echo "<tr><th>Name</th></tr>\n";
  echo "</thead>\n";
  echo "<tbody>\n";
  foreach($dirlist as $file) {
    echo "<form action=\"MusicP.php\" Method = \"POST\" \">\n";

   echo "<input value =\" F:\\uni\\M2\\Thesis\\hmayed\\ali\\songs wav\\{$file['name']}\" type = \"submit\" name= \"submit\" id=\"{$file['name']}\">\n";

    echo "</tr>\n";
  }
  echo "</form>\n";
  echo "</table>\n\n";


?>
<audio src = "File:///F:\uni\M2\Thesis\songs\1.mp3" type= "audio/mp3" controls>
Your browser does not support the audio element.
</audio>

<body>
</body>
</html>

So my questions:

Upvotes: 0

Views: 1275

Answers (1)

Progrock
Progrock

Reputation: 7485

You could use a Php script to proxy to a shell command to get a file list:

<?php

print nl2br(shell_exec('find /tmp'));

Replace /tmp in the example above with a user contributed value.

Further, to play media files you could do something like the following (please bear in mind the security ramifications):

<?php

$file = isset($_GET['file']) ? $_GET['file'] : null;

if($file) serve_file($file);

function serve_file($file) {
    header('Content-Type: audio/mpeg');
    readfile($file);
    exit;
}

$dir   = '/tmp';
$music = shell_exec("find $dir -name '*.mp3'");
$music = explode("\n", $music);
$music = array_filter($music);

// html here...

foreach($music as $file) {?>
    <a href="?file=<?php echo urlencode($file) ?>"><?php echo $file; ?></a><br />
<?
}

Upvotes: 2

Related Questions