file_check_location
Definition
file_check_location($source, $directory = '')
drupal/includes/file.inc, line 277
Description
Check if a file is really located inside $directory. Should be used to make sure a file specified is really located within the directory to prevent exploits.
// Returns false:
file_check_location('/www/example.com/files/../../../etc/passwd', '/www/example.com/files');
Parameters
$source A string set to the file to check.
$directory A string where the file should be located.
Return value
0 for invalid path or the real path of the source.
Related topics
Name | Description |
|---|---|
| File interface | Common file handling functions. |
Code
function file_check_location($source, $directory = '') {
$check = realpath($source);
if ($check) {
$source = $check;
}
else {
// This file does not yet exist
$source = realpath(dirname($source)) .'/'. basename($source);
}
$directory = realpath($directory);
if ($directory && strpos($source, $directory) !== 0) {
return 0;
}
return $source;
}