May 22, 201115 yr Basically I know with some hosting companies return all the files and folders as a default page if no index is present. Well mine doesn't so I started creating a simple script to return the files and folders, and it just went on from there really to a more advanced "directory viewer". A friend of mine (djekl) helped with the form showing if password and/or IP is correct or not. <?php /* * Code placed here is coded by djeklDevelopments * * [iNFORMATION] * * This coe here is a nice and simple PHP session code. * It is used so that you (the developer) can authenticate on this page, and simply * move about your site authenticated. Its used to prevent unatutherised access to * anything you may not want people to see. * * [uSAGE] * * In this section I will give you the code to use on any and all protected pages! */ // This code is only for the login page! session_start(); function killSession() { if(isset($_SESSION['autherised'])) { // destroy session by unset() function unset( $_SESSION['autherised'] ); // destroy the session session_destroy(); } @header('Location: index.php'); // Location to login page! (best to use a full url inc http/s) exit; } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Directory Viewer</title> <style = "text/css"> Body {font-family:Segoe UI;} </style> </head> <body> <h1 align=center>Directory Viewer</h1> <?php // login false to reset password box // change to true if you want to make true only once $_SESSION['autherised'] = false; $userip = ($_SERVER['REMOTE_ADDR']); // Enter your IP below $ip = '28.24.24.289'; $password = $_POST['password']; // eneter your password below $pword = 'password'; if ($userip == $ip || $_POST['submit'] && $password == $pword) { //login successful $_SESSION['autherised'] = true; if($userip == $ip) { $_SESSION['IP'] = true; // Autherised via IP } else { $_SESSION['IP'] = false; // Autherised via Password } } else { if($_POST['submit'] && $password != $pword) { echo "<center>The password you entered is incorrect.</center><BR>"; } echo "<center><form id=\"form1\" name=\"form1\" method=\"post\" action=\"index.php\"><label for=\"res\">Please enter a password to continue: </label><input type=\"password\" name=\"password\" /><input type=\"submit\" name=\"submit\" id=\"submit\" value=\"Submit\" /></form></center>"; } date_default_timezone_set('Europe/London'); $directory_self = str_replace(basename($_SERVER['PHP_SELF']), '', $_SERVER['PHP_SELF']); $date = strtolower(date("F")); $logfile = $_SERVER['DOCUMENT_ROOT'] . $directory_self . $date . "_log.html"; if ($_SESSION['IP']) { $logdetails = date("j F Y, g:i a") . ' : ' . "<font color=\"#00FF08\">" . str_replace($ip, 'MyIP', $userip) . "</font>"; } else { $logdetails = date("j F Y, g:i a") . ' : ' . "<font color=\"red\">" . $userip . "</font>"; } $fp = fopen($logfile, "a"); fwrite($fp, $logdetails); fwrite($fp, "<br>"); fclose($fp); if ($_SESSION['autherised']) { // enter the path to your directory $path = "/homepages/domain.com/dev/"; $dir_handle = @opendir($path) or die("Unable to open $path"); while (false !== ($file = readdir($dir_handle))) { /* // if you want to return the go back folder if (strpos($file, '..') !== false) { //Return Go Back Folder echo "<center><table border=\"1\" width=\"440\" cellpadding=\"3\" cellspacing=\"3\" class=\"center\"><tr><th>Go Back</th></tr><td align=\"center\"><b><a href=\"/dev/$file\">$file</a></b></td></table></center>"; } */ // file and folders you don't want to be returned if($file == "." || $file == ".." || $file == "index.php" || $file == $date . "_log.html") continue; if (strpos($file, '.') === false) { echo "<center><table border=\"1\" width=\"440\" cellpadding=\"3\" cellspacing=\"3\" class=\"center\"><tr><th>Directory</th></tr><td align=\"center\"><b><a href=\"/dev/$file\">$file</a></b></td></table></center>"; } else { echo "<center><table border=\"1\" width=\"440\" cellpadding=\"3\" cellspacing=\"3\" class=\"center\"><tr><th>File</th></tr><td align=\"center\"><b><a href=\"/dev/$file\">$file</a></b></td></table></center>"; } } closedir($dir_handle); } if ($_SESSION['autherised']) { echo "<br><center><a href=\"" . $date . "_log.html\">Click here to view the log</a></center><br>"; echo "<center></br><b>IP:</b> <font color=\"#00FF08\">" . $userip . "</font></center>"; } else { echo "<center></br><b>IP:</b> <font color=\"red\">" . $userip . "</font></br>You're not from a verified IP address, most of the actions you try to complete on pages after this may not work.</center>"; } ?> </body> </html> If there are any problems when using this let me know, or if you have anyway I can improve it let me know. Make sure you change the a href=""'s. Hope you like my first post on the site
May 22, 201115 yr Sharing is cool, thanks for doing it! found some problems however that you should fix up... i wont get to nit picky (i can get be a perfectionist at times!) ok so 2 code improvments: 1) when checking vars use if (isset($_SESSION['autherised'])) { } 2) dont use $_SERVER['PHP_SELF'] as an attacker can play with it __FILE__ will give you the same result and a major security issue, granted its not the easiest thing todo but i could by-pass your login system and anyone with access to your router could do so with not much hassle at all! especially if the attacker is motivated to destroy your world... humans can be very resourceful! Allowing people in just from the IP used is I'm sorry to say stupid... not so bad if the script is to be only used by you... but it ain't secure thats for sure I would flat out remove that bit or change it so the session is bound to the IP (not so good for people on very managed ISP's but hey) but you would have to actually login to get authed in the first place. It's great seeing people post scripts, keep it up
May 22, 201115 yr Author Sharing is cool, thanks for doing it! found some problems however that you should fix up... i wont get to nit picky (i can get be a perfectionist at times!) ok so 2 code improvments: 1) when checking vars use if (isset($_SESSION['autherised'])) { } 2) dont use $_SERVER['PHP_SELF'] as an attacker can play with it __FILE__ will give you the same result and a major security issue, granted its not the easiest thing todo but i could by-pass your login system and anyone with access to your router could do so with not much hassle at all! especially if the attacker is motivated to destroy your world... humans can be very resourceful! Allowing people in just from the IP used is I'm sorry to say stupid... not so bad if the script is to be only used by you... but it ain't secure thats for sure I would flat out remove that bit or change it so the session is bound to the IP (not so good for people on very managed ISP's but hey) but you would have to actually login to get authed in the first place. It's great seeing people post scripts, keep it up Thank you! I will take what you said into consideration and implement it. The script is only for me to be honest, but if I want to get better using PHP I should make the best script I can! One thing, do you mean I should replace: if ($_SESSION['autherised']) { // with if (isset($_SESSION['autherised'])) { If so, that doesn't work. Edited May 22, 201115 yr by Deany
May 22, 201115 yr Thank you! I will take what you said into consideration and implement it. The script is only for me to be honest, but if I want to get better using PHP I should make the best script I can! One thing, do you mean I should replace: if ($_SESSION['autherised']) { // with if (isset($_SESSION['autherised'])) { If so, that doesn't work. isset() is a language construct thats checks the variable does exist in the runtime before trying to access the var... you get a warning if "$_SESSION['autherised']" has not been made and you do a check on it ya see. http://php.net/manual/en/function.isset.php // more code but the isset construct is very fast so actually speeds things up when the var doesn't even exist if (isset($_SESSION['autherised']) && $_SESSION['autherised'] === true) { Edited May 22, 201115 yr by SniderDK
May 22, 201115 yr Author isset() is a language construct thats checks the variable does exist in the runtime before trying to access the var... you get a warning if "$_SESSION['autherised']" has not been made and you do a check on it ya see. http://php.net/manual/en/function.isset.php // more code but the isset construct is very fast so actually speeds things up when the var doesn't even exist if (isset($_SESSION['autherised']) && $_SESSION['autherised'] === true) { Ahh, I see. Thanks for sharing that
Create an account or sign in to comment