| version 1.16, 2002/02/21 09:03:54 |
version 1.17, 2002/02/21 09:27:26 |
| Line 101 if ($phpWebFileManager_DENY_DIR_FOLLOW_S |
|
| Line 101 if ($phpWebFileManager_DENY_DIR_FOLLOW_S |
|
| $fm_test_symlink = $fm_dir; |
$fm_test_symlink = $fm_dir; |
| |
|
| while ($fm_test_symlink != '') { |
while ($fm_test_symlink != '') { |
| if (is_link($fm_test_symlink) || is_link("$fm_test_symlink/")) { |
if (@is_link($fm_test_symlink) || @is_link("$fm_test_symlink/")) { |
| $fm_dir = $phpWebFileManager_START_DIR; |
$fm_dir = $phpWebFileManager_START_DIR; |
| break; |
break; |
| } |
} |
| Line 111 if ($phpWebFileManager_DENY_DIR_FOLLOW_S |
|
| Line 111 if ($phpWebFileManager_DENY_DIR_FOLLOW_S |
|
| } |
} |
| } |
} |
| |
|
| if (! isset($fm_dir) || $phpWebFileManager_DENY_DIR_ENTER) |
if (! isset($fm_dir) || $phpWebFileManager_DENY_DIR_ENTER) { |
| $fm_dir = $phpWebFileManager_START_DIR; |
$fm_dir = $phpWebFileManager_START_DIR; |
| |
} |
| |
|
| /* Dirty & safe. */ |
/* Dirty & safe. */ |
| $fm_dir = preg_replace('/\/\/+/','/', $fm_dir . '/'); |
$fm_dir = preg_replace('/\/\/+/','/', $fm_dir . '/'); |
| $fm_dir = preg_replace("/^(|.*\/)\.\.\/([^\.\/][^\.\/]|[^\/][^\.\/]|[^\/][^\.\/]|[^\/]{3,})\/(.*)$/", "\\1\\3", $fm_dir); |
$fm_dir = preg_replace("/^(|.*\/)\.\.\/([^\.\/][^\.\/]|[^\/][^\.\/]|[^\/][^\.\/]|[^\/]{3,})\/(.*)$/", "\\1\\3", $fm_dir); |
| $fm_dir = preg_replace("/^(|.*\/)([^\/\.][^\.\/]|[^\/][^\.\/]|[^\/][^\.\/]|[^\/]{3,})\/\.\.\/(.*)$/", "\\1\\3", $fm_dir); |
$fm_dir = preg_replace("/^(|.*\/)([^\/\.][^\.\/]|[^\/][^\.\/]|[^\/][^\.\/]|[^\/]{3,})\/\.\.\/(.*)$/", "\\1\\3", $fm_dir); |
| |
|
| while (preg_match("/^(|.*\/)\.\.\/(.*)$/", $fm_dir)) |
while (preg_match("/^(|.*\/)\.\.\/(.*)$/", $fm_dir)) |
| $fm_dir = preg_replace("/^(|.*\/)\.\.\/(.*)$/", "\\1\\2", $fm_dir); |
$fm_dir = preg_replace("/^(|.*\/)\.\.\/(.*)$/", "\\1\\2", $fm_dir); |
| while ($fm_dir[0] == '/') |
while ($fm_dir[0] == '/') |
| $fm_dir = substr($fm_dir, 1, strlen($fm_dir)); |
$fm_dir = substr($fm_dir, 1, strlen($fm_dir)); |
| |
|
| /* Hidden parameters */ |
/* Hidden parameters */ |
| $origvars = $phpWebFileManager_ORIGINAL_VARIABLES; |
$origvars = $phpWebFileManager_ORIGINAL_VARIABLES; |
| if (strlen($origvars) > 0 && $origvars[strlen($origvars)-1] != '&') |
if (strlen($origvars) > 0 && $origvars[strlen($origvars)-1] != '&') |
| $origvars .= '&'; |
$origvars .= '&'; |
| |
|
| /* Prepare HTML encode of some variables. */ |
/* Prepare HTML encode of some variables. */ |
| $fm_filename_he = htmlentities($fm_filename); |
$fm_filename_he = htmlentities($fm_filename); |
| $fm_dir_he = htmlentities($fm_dir); |
$fm_dir_he = htmlentities($fm_dir); |
| |
|
| /* Prepare URL & HTML encode of some variables. */ |
/* Prepare URL & HTML encode of some variables. */ |
| //$fm_filename_ue = htmlentities(rawurlencode($fm_filename)); |
//$fm_filename_ue = htmlentities(rawurlencode($fm_filename)); |
| $fm_dir_ue = htmlentities(rawurlencode($fm_dir)); |
$fm_dir_ue = htmlentities(rawurlencode($fm_dir)); |
| $PHP_SELF_origvars_ue = htmlentities("$PHP_SELF?".rawurlencode($origvars)); |
$PHP_SELF_origvars_ue = htmlentities("$PHP_SELF?".rawurlencode($origvars)); |
| |
|
| /* |
/* |
| * Form |
* Form |
| */ |
*/ |
| echo '<form enctype="multipart/form-data" method=post' |
echo '<form enctype="multipart/form-data" method=post' |
| . ' action="' . htmlentities($PHP_SELF) . '">'; |
. ' action="' . htmlentities($PHP_SELF) . '">'; |
| |
|
| write_origvars_html($origvars); |
write_origvars_html($origvars); |
| |
|
| echo '<input type=hidden value="'.$fm_filename_he.'" name=fm_filename>'; |
echo '<input type=hidden value="'.$fm_filename_he.'" name=fm_filename>'; |
| echo '<input type=hidden value="'.$fm_dir_he.'" name=fm_dir>'; |
echo '<input type=hidden value="'.$fm_dir_he.'" name=fm_dir>'; |
| |
|
| /* Store the starting working directory. */ |
/* Store the starting working directory. */ |
| $orig_dir = getcwd(); |
$orig_dir = getcwd(); |
| |
|
| /* Change to root directory. */ |
/* Change to root directory. */ |
| if (@is_dir($phpWebFileManager_ROOT_DIR)) |
if (@is_dir($phpWebFileManager_ROOT_DIR)) |
| chdir($phpWebFileManager_ROOT_DIR); |
chdir($phpWebFileManager_ROOT_DIR); |
| $root_dir = getcwd(); |
$root_dir = getcwd(); |
|
|
| */ |
*/ |
| if (($fm_action == "create_directory" |
if (($fm_action == "create_directory" |
| && ! $phpWebFileManager_DENY_DIR_CREATE) |
&& ! $phpWebFileManager_DENY_DIR_CREATE) |
| || ($fm_action == "create_file |
|| ($fm_action == "create_file" |
| && ! $phpWebFileManager_DENY_FILE_CREATE)) { |
&& ! $phpWebFileManager_DENY_FILE_CREATE)) { |
| if ($fm_new_filename != "" && |
if ($fm_new_filename != "" && |
| (($submit == $phpWebFileManager_LANG['dir_create'] |
(($submit == $phpWebFileManager_LANG['dir_create'] |
| && $fm_action == "create_directory") |
&& $fm_action == "create_directory") |
| || ($submit == $phpWebFileManager_LANG['file_create'] |
|| ($submit == $phpWebFileManager_LANG['file_create'] |
| && $fm_action == "create_file") |
&& $fm_action == "create_file")) |
| )) { |
) { |
| if ($fm_action == "create_directory") { |
if ($fm_action == "create_directory") { |
| if (@mkdir($fm_new_filename, $phpWebFileManager_DIR_MODE) |
if (@mkdir($fm_new_filename, |
| == false) |
$phpWebFileManager_DIR_MODE) == false) |
| echo_message($phpWebFileManager_LANG['dir_create_err']); |
echo_message($phpWebFileManager_LANG['dir_create_err']); |
| else |
else |
| echo_message($phpWebFileManager_LANG['dir_create_ok']); |
echo_message($phpWebFileManager_LANG['dir_create_ok']); |
|
|
| echo_message($phpWebFileManager_LANG['file_create_err1']); |
echo_message($phpWebFileManager_LANG['file_create_err1']); |
| else { |
else { |
| if (($fh = @fopen($fm_new_filename, "w")) == false) |
if (($fh = @fopen($fm_new_filename, "w")) == false) |
| echo_message($phpWebFileManager_LANG['file_create_err2']); |
echo_message($phpWebFileManager_LANG[file_create_err2]); |
| else { |
else { |
| fclose($fh); |
fclose($fh); |
| echo_message($phpWebFileManager_LANG['file_create_ok']); |
echo_message($phpWebFileManager_LANG['file_create_ok']); |
|
|
| $entry_he = htmlentities($entry); |
$entry_he = htmlentities($entry); |
| $entry_ue = htmlentities(rawurlencode($entry)); |
$entry_ue = htmlentities(rawurlencode($entry)); |
| if ($entry != '.' && $entry != '..' && |
if ($entry != '.' && $entry != '..' && |
| (($k == 0 && is_dir($entry))||($k == 1 && ! is_dir($entry)))) { |
(($k == 0 && is_dir($entry)) |
| |
|| ($k == 1 && ! is_dir($entry)))) { |
| |
|
| echo "<tr valign=middle"; |
echo "<tr valign=middle"; |
| $line++; |
$line++; |