Page 1 of 1

User Specified Directory to start from...

Posted: Wed Nov 26, 2003 12:29 pm
by infolock
I've searched on this for a while now. What I'm wanting to do is setup a form that asks the user to specify a directory that my script will look for files in to parse.

I was looking to setup the form to look like the file form ( ie, using <input type="hidden" name="select"> <input name="directory" type="file"> ) since it allows the user a quick easy way to navigate through directories. However, it says that you cannot allow the user to just specifiy a directory due to security issues.

Well, while I can understand that, the fact is though this script will never be used by any other users except for the admin on his/her intRAnet, so if they wanted to exploit the vulnerability, they could and it wouldn't matter(for obvious reason .. ).

anyways, my question is, is there a way to allow a user to specify a directory without having to type the directory in, and just by navigating like you do with files? thanks.

Posted: Wed Nov 26, 2003 2:05 pm
by infolock
any thoughts on this?

Posted: Wed Nov 26, 2003 4:00 pm
by xisle
Let me take a shot at this, I may be all wet 8O
They will need to upload files to the web server in order for
you to parse them, so the type="file" is the correct html form tag.

Choosing a directory with this form tag <input type="file">
will browse local directories on their machine and allow them
to upload to the temp server directory.

You could allow them to upload a gzipped file if you want
to parse multiple files from that location or they will have
to upload one file at a time.

If you intended on allowing them to browse the server
directories, you build a select menu based on what
directories they are allowed to view..

Hope this helps..

Posted: Wed Nov 26, 2003 5:23 pm
by infolock
well, that's the thing. the user isn't gonna be uploading anything. let me explain a little better.

i'm allowing a user to run my script on their server to parse a log file. in other words, my script will actually be on their box for reporting.

so they aren't uploading anything, and instead, my program is reading the directory they specify for files to be parsed in. again, since this directory will vary from user to user, i'm just needing to be able to let the user navigate to what directory they choose, click go, and it set that directory as the primary directory for the script to read from.

edit : again, this has nothing to do with uploading files, but just trying to figure out how the user can specify a folder in which their logs will be at. I just used the files input type as an example of how i'd like the users to be able to navigate... only navigating for directories on their box, not files..

Posted: Wed Nov 26, 2003 6:39 pm
by mchaggis
Unfortunately there is no way round your problem, the only thing I could possibly suggest is looking into javascript, as I know that I is possible to scan the harddrive files (or at least it used to be) as it used to be a practical joke to put a javascript of a web page that displays messages in the status bar to the affect of "Deleting file xyz"

Unfortunately, I would know where to start with writing a script like that.

Another alternative would get them to lauch windows explorer and copy the path from the address bar??

Posted: Wed Nov 26, 2003 7:14 pm
by infolock
thanks mchaggis. yeah, that was the method i was gonna default to (explorer) if there was no such means of doing what i needed. that sux though :( kinda thought php would have made it possible :\

only word that i know of that can describe this, is ... ouch.