Viewing Documents Stored Outside the Domain’s Folder [closed]

I’m trying to fetch the files in a folder that it outside the site’s path and, with the help of @Marwane Ezzaze and some programming of my own I am using the code below to provide a list of the files needed. This looks in the $SecurePath (defined in the included common.php), then pulls up a list of any files in folders that begin with 006. The documents are primarily images but some are PDFs and possibly others.

This is working properly. First, to send the path, it was necessary to urlencode it which this does and it uses addslashes specifically for the parenthesis in the path which at first caused a problem but no longer.

test.php

<?php include_once $_SERVER ['DOCUMENT_ROOT'] . "/internals/configuration/common.php";

$EntryID = 6;
$EntryID =  substr(str_repeat(0, 3) . $EntryID, -3);
//$folders = glob("{$SecurePath}verified/{$EntryID}-*");

$folders = array_filter(glob("{$SecurePath}{$EntryID}-*", GLOB_ONLYDIR));

if (!empty($folders)) :
    foreach($folders as $folder) :
        $handle = opendir($folder);
        while (false != ($file = readdir($handle))) :
            if ($file != "." && $file != "..") :
                $folderlink = urlencode(addslashes(basename($folder)));
                $filelink = "/internals/administration/secure_viewer.php?file=$file&folder=$folderlink";
                echo "<p>$folderlink<br>n<a href="$filelink">$file</a><br>n";
            endif;
        endwhile;
    endforeach;
else :
    echo "There are no files for this entry!";
endif;

?>

Since the documents are outside the site’s file system, a PHP viewer was needed to open them and that is what I am having trouble with.

When testing the path directly in the browser with it encoded, it always gave 404 File Not Found and also had trouble with the encoded parenthesis that each folder has so it is being decoded again below. Typically when I try to open one, I see nothing and the Apache server error.log shows client denied by server configuration which is odd because I can open the document in the browser by pasting in the link. Any thoughts?

secure_view.php

<?php include_once $_SERVER ['DOCUMENT_ROOT'] . "/internals/configuration/common.php";

// Limit access to Administrator
accessRedirect(2,"/test.php","/internals/administration/");

// Fetch parameters
$fileDir = (isset($_GET['folder'])) ? $_GET['folder'] : "";
$file = (isset($_GET['file'])) ? $_GET['file'] : "";

// Build full path
$fileDir = urldecode("{$SecurePath}$fileDir/$file");

// Sample path built above
//$fileDir = urldecode("/var/www/html/006-1930+Make+Model+VIN+(Location)/IMG_2494.JPG");

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$type = finfo_file($finfo, $fileDir);
finfo_close($finfo);

if (file_exists($fileDir)) :
    $contents = file_get_contents($fileDir);
    header("Content-type: ".$type.""");
    echo $contents;
else :
    echo "The file cannot be found";
endif;

?>

Answer

If I were you, I would glob all the folders with that name, then loop thru them and get all the files. This is the approach I would take:

$EntryID = 6;
$EntryID =  substr(str_repeat(0, 3) . $EntryID, -3);
$folders = array_filter(glob("{$SecurePath}verified/{$EntryID}-*", GLOB_ONLYDIR));

foreach($folders as $folder) {
    $handle = opendir($folder);
    while (false != ($file = readdir($handle))) {
        if ($file != "." && $file != "..") :
            echo "$file<br>n";
        endif;
    }
}