Accessing files outside the root directing

My client asked me to do a website where a user can enter a path on the machine, PHP should scan the path and load all the media files in the directory and subdirectories. The user can enter any path, Desktop, or external drives, whatever, outside the root directory. That’s what the client wants and he’s running on Linux.

I told him php can’t access files outside the root, he said yes it can, he said I should use some proxy and he sent me this script

<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Untitled Document</title>
</head>

<?PHP
session_start();
function getFileList($dir)
  {
    // array to hold return value
    $retval = array();

    // add trailing slash if missing
    if(substr($dir, -1) != "/") $dir .= "/";

    // open pointer to directory and read list of files
    $d = @dir($dir) or die("getFileList: Failed opening directory $dir for reading");
    while(false !== ($entry = $d->read())) {
      // skip hidden files
      if($entry[0] == ".") continue;
      if(is_dir("$dir$entry")) {
        $retval[] = array(
          "name" => "$entry/"
        );
      } elseif(is_readable("$dir$entry")) {
        $retval[] = array(
          "name" => "$entry"
        );
      }
    }
    $d->close();

    return $retval;
  }
$dirlist = getFileList("F:uniM2Thesishmayedalisongs wav");

  // output file list in HTML TABLE format
  echo "<table border="1">n";
  echo "<thead>n";
  echo "<tr><th>Name</th></tr>n";
  echo "</thead>n";
  echo "<tbody>n";
  foreach($dirlist as $file) {
    echo "<form action="MusicP.php" Method = "POST" ">n";

   echo "<input value =" F:\uni\M2\Thesis\hmayed\ali\songs wav\{$file['name']}" type = "submit" name= "submit" id="{$file['name']}">n";

    echo "</tr>n";
  }
  echo "</form>n";
  echo "</table>nn";


?>
<audio src = "File:///F:uniM2Thesissongs1.mp3" type= "audio/mp3" controls>
Your browser does not support the audio element.
</audio>

<body>
</body>
</html>

So my questions:

Does this script or this type of scripts work? Is the project feasible?
And what happens if I create an apache virtual server to / would it read all the file system? I have never tried it.

Answer

You could use a Php script to proxy to a shell command to get a file list:

<?php

print nl2br(shell_exec('find /tmp'));

Replace /tmp in the example above with a user contributed value.

Further, to play media files you could do something like the following (please bear in mind the security ramifications):

<?php

$file = isset($_GET['file']) ? $_GET['file'] : null;

if($file) serve_file($file);

function serve_file($file) {
    header('Content-Type: audio/mpeg');
    readfile($file);
    exit;
}

$dir   = '/tmp';
$music = shell_exec("find $dir -name '*.mp3'");
$music = explode("n", $music);
$music = array_filter($music);

// html here...

foreach($music as $file) {?>
    <a href="?file=<?php echo urlencode($file) ?>"><?php echo $file; ?></a><br />
<?
}

Advertisement

Answer