Path: csiph.com!x330-a1.tempe.blueboxinc.net!newsfeed.hal-mli.net!feeder3.hal-mli.net!newsfeed.hal-mli.net!feeder1.hal-mli.net!news.ripco.com!news.glorb.com!news-in-01.newsfeed.easynews.com!easynews!core-easynews-01!easynews.com!en-nntp-11.dc1.easynews.com.POSTED!not-for-mail From: Harry Putnam Newsgroups: comp.lang.php Subject: Re: Why and wherefore file downloads Organization: Still searching... References: <87ehv25dm4.fsf@newsguy.com> <9neg3fFicpU1@mid.uni-berlin.de> User-Agent: Gnus/5.110018 (No Gnus v0.18) Emacs/24.0.92 (gnu/linux) Message-ID: <87fwff6t2h.fsf@newsguy.com> Cancel-Lock: sha1:d+OlHQLl3SyOGSCa84f36Olct4w= MIME-Version: 1.0 Content-Type: text/plain Lines: 68 X-Complaints-To: abuse@easynews.com X-Complaints-Info: Please be sure to forward a copy of ALL headers otherwise we will be unable to process your complaint properly. Date: Mon, 16 Jan 2012 20:01:10 -0500 Xref: x330-a1.tempe.blueboxinc.net comp.lang.php:4488 "M. Strobel" writes: > Am 14.01.2012 19:43, schrieb Harry Putnam: > ---cut >> ------- --------- ---=--- --------- -------- >> From_mohitsharma.net.php >> >> php >> >> > // The file path where the file exists >> $filepath = "**HERE**".$_GET['filename'].""; > ---cut > >> @readfile($filepath); >> ?> > --------------cut > >> ------- 8< snip ---------- 8< snip ---------- 8> #!/usr/bin/perl >> >> use strict; >> use warnings; >> use diagnostics; >> >> my ($frdir,$reg, @files, $php); >> $php = './Frommohitsharma.net.php'; > > your perl calls Frommohitsharma.net.php, but you print From_mohitsharma.net.php. > > You are calling a different script. No, that is something added when I wrote this message, It was to indicate the php script and typed wrong inadvertently, not a typo exactly, more like a memory lapse. But it would have no bearing on what gets called. The script being called is whatever is in the variable $php and there is only one such script available. > This is the only explanation because the parameter filepath is used unchanged in the > readfile() function and it should not work if you change it. That is the odd part. Even if I do change it so that it doesn't really point to the files, it still works. For example, I just tried this: $filepath = "".$_GET['filename'].""; # no path listed at all. Yet I am still shown an mp3 to play or download. And this: $filepath = "/not".$_GET['filename'].""; ## wrong non-existent path ## listed At first I thought it might be because the mp3s where in the same dir as the php script. So I changed that just to find out. The 1 lonesome mp3 has been moved to /test I don't have root on the server but can control my little bit of it. PS - do you mind explaining a bit in an off-group (via email) message, what you mean by the bit about insecure? Note: I do not munge my email address ... its real.