-2

How would I easily find the current url and all of the GET paramaters in that URL with PHP? I want to track which GET paramaters are being passed to the current url. If somebody could give me the PHP command to do this, then that would be great! Thanks! Here is my code:

<?php

$filedir = './';

$filename = $_GET['file'];
//security check
if(strpos(realpath($filename), PATH_TO_VALID_MP3s) !== 0) { die('bad path!'); } 
$path = $filedir . $filename;

if (!is_file($path) OR connection_status() != 0)
{
    exit();
}

ob_end_clean();

header('Cache-Control: no-store, no-cache, must-revalidate');
header('Cache-Control: post-check=0, pre-check=0', false);
header('Pragma: no-cache');
header('Expires: '. gmdate('D, d M Y H:i:s', mktime(date('H')+2, date('i'), date('s'), date('m'), date('d'), date('Y'))).' GMT');
header('Last-Modified: '. gmdate('D, d M Y H:i:s').' GMT');
header('Content-Type: application/octet-stream');
header('Content-Length: '. @filesize($path));
header('Content-Disposition: attachment; filename="'. $filename .'"');
header('Content-Transfer-Encoding: binary');

if ($file = @fopen($path, 'rb'))
{
    while (!feof($file) AND connection_status() == 0)
{
    echo fread($file, 1024 * 8);
}

flush();
}

@fclose($file);
?>
Shadowpat
  • 21
  • 6

2 Answers2

1

The $_SERVER and $_GET arrays are your friends ;)

hek2mgl
  • 152,036
  • 28
  • 249
  • 266
  • Further note, that `$_SERVER` will also contain the unparsed query string. This might be interesting if you are interested in the order of GET params – hek2mgl May 13 '13 at 21:21
  • Yes, i know, but people visit download.php?file=filename.mp3 and that would download filename.mp3.... this is in a directory with only nonvulnerable mp3 files, but i just want to make sure they dont find a way to download root directory files. That is why i ask – Shadowpat May 13 '13 at 21:22
  • `if(strpos(realpath($filename), PATH_TO_VALID_MP3s) !== 0) { die('bad path!'); }` – hek2mgl May 13 '13 at 21:34
  • Ohhh that looks awesome!!!! CAnt wait to see what it does, one minute please! – Shadowpat May 13 '13 at 21:42
  • That should go at the very top of the page, correct? – Shadowpat May 13 '13 at 21:43
  • OOPS! One problem with that @hek2mgl, some of the files are WAV and MP3 and other audio, is there like one that will be for all audio instead of just MP3? – Shadowpat May 13 '13 at 21:46
0

There is already a global variable present that contains all the GET variables.

$_GET

http://php.net/manual/en/reserved.variables.get.php

An alternative is the $_REQUEST global.

http://php.net/manual/en/reserved.variables.request.php

An associative array that by default contains the contents of $_GET, $_POST and $_COOKIE.

Bart
  • 17,070
  • 5
  • 61
  • 80