oncode
12/17/2014 - 12:39 PM

Check for directory traversal attack.

Check for directory traversal attack.

traversal.php
content_copyfile_download
<?php

// access within this base path folder
$basePath = 'folder/';
// example path of restricted folder
$path = 'folder/test/../../root';

$realBasePath = realpath($basePath);
$realPath = realpath($path);

if ($realPath === false || strpos($realPath, $realBasePath) !== 0) {
  echo 'Directory traversal attack!';
}