files access access deneid

Question

Hi have this code to manage my main page. Everything works fine on my local server at home,i'm using easyphp. But on my webhosting server i got this error

Warning: scandir(D:\Hosting\12067690\html/,D:\Hosting\12067690\html/) [function.scandir]: Access is denied. (code: 5) in D:\Hosting\12067690\html\index_menu.php on line 65

Any ideas? thank you in advance.

<?php
          $dir = $_SERVER['DOCUMENT_ROOT'].stripslashes(dirname($_SERVER['PHP_SELF'])).'/';
            if(!empty($_GET['p'])){
                $pages = scandir($dir, 0);
                unset($pages[0], $pages[1]);
                $p = $_GET['p'];
                if (in_array($p.'.htm', $pages)){
                    include($dir.'/'.$p.'.htm');
                }else{
                echo 'Sorry, page introuvable';                     
                }
            }else{
                include($dir.'/enter_index01.htm');
            }
        ?>

Sounds like a permissions issue.You don't have the rights to access the file. You can check this with the is_readable('/location/') function. — Linus, Apr 24 '15 at 11:36
Thank you lockdown and sanjay. i would like to know how i'm suppose to do that proprely in my code. how i can give access to my folder to read those files. localy i don't have to do that. Thanks. — , Apr 24 '15 at 11:38
You might need to login as root to change the permission settings which may not be done using script(www-data user). — Sanjay Kumar N S, Apr 24 '15 at 11:40

score 0 · Accepted Answer · answered Apr 24 '15 at 11:41

0

You could make it simpler by using file_exists instead of using all the scandir stuff:

$p = $_GET['p']; // WARNING: sanitize this before using it in production app
if (file_exists($dir.'/'.$p.'.htm')){
    include($dir.'/'.$p.'.htm');
} else {
    echo 'Sorry, page introuvable';
}

And sanitize user input (such as limiting it to certain path, whitelisting etc).

answered Apr 24 '15 at 11:41

Linus

899
3
19
33

sanitizing your code: $p = $_GET['p']; $new_p = filter_var($p, FILTER_SANITIZE_STRING); for example this is input of the user that has html codes $p =
Hello
this is the one sanitized it will remove all unwanted characters $new_p = Hello – Linus Apr 24 '15 at 11:47

files access access deneid

1 Answers1

Hello