Lynob Lynob - 4 months ago 7x
Linux Question

Accessing files outside the root directing

My client asked me to do a website where a user can enter a path on the machine, PHP should scan the path and load all the media files in the directory and subdirectories. The user can enter any path, Desktop, or external drives, whatever, outside the root directory. That's what the client wants and he's running on Linux.

I told him php can't access files outside the root, he said yes it can, he said I should use some proxy and he sent me this script

<!doctype html>
<meta charset="utf-8">
<title>Untitled Document</title>

function getFileList($dir)
// array to hold return value
$retval = array();

// add trailing slash if missing
if(substr($dir, -1) != "/") $dir .= "/";

// open pointer to directory and read list of files
$d = @dir($dir) or die("getFileList: Failed opening directory $dir for reading");
while(false !== ($entry = $d->read())) {
// skip hidden files
if($entry[0] == ".") continue;
if(is_dir("$dir$entry")) {
$retval[] = array(
"name" => "$entry/"
} elseif(is_readable("$dir$entry")) {
$retval[] = array(
"name" => "$entry"

return $retval;
$dirlist = getFileList("F:\uni\M2\Thesis\hmayed\ali\songs wav");

// output file list in HTML TABLE format
echo "<table border=\"1\">\n";
echo "<thead>\n";
echo "<tr><th>Name</th></tr>\n";
echo "</thead>\n";
echo "<tbody>\n";
foreach($dirlist as $file) {
echo "<form action=\"MusicP.php\" Method = \"POST\" \">\n";

echo "<input value =\" F:\\uni\\M2\\Thesis\\hmayed\\ali\\songs wav\\{$file['name']}\" type = \"submit\" name= \"submit\" id=\"{$file['name']}\">\n";

echo "</tr>\n";
echo "</form>\n";
echo "</table>\n\n";

<audio src = "File:///F:\uni\M2\Thesis\songs\1.mp3" type= "audio/mp3" controls>
Your browser does not support the audio element.


So my questions:

  • Does this script or this type of scripts work? Is the project

  • And what happens if I create an apache virtual server to
    would it read all the file system? I have never tried it.


You could use a Php script to proxy to a shell command to get a file list:


print nl2br(shell_exec('find /tmp'));

Replace /tmp in the example above with a user contributed value.

Further, to play media files you could do something like the following (please bear in mind the security ramifications):


$file = isset($_GET['file']) ? $_GET['file'] : null;

if($file) serve_file($file);

function serve_file($file) {
    header('Content-type: audio/mpeg');

$dir   = '/tmp';
$music = shell_exec("find $dir -name '*.mp3'");
$music = explode("\n", $music);
$music = array_filter($music);

// html here...

foreach($music as $file) {?>
    <a href="?file=<?php echo urlencode($file) ?>"><?php echo $file; ?></a><br />