Comments on: The PATH_TRANSLATED blues

By: DW

DW — Tue, 18 Jul 2006 22:21:33 +0000

getcwd() is the solution I chose :)

By: Rajesh

Rajesh — Mon, 19 Jun 2006 20:30:36 +0000

I know at least one place where a programmer has used
eval(file_get_contents(’some_script.php’)) to include a file.
I don’t exactly remember why but it solved a nice security
problem.

The array_shift(get_included_files()) won’t work in this case
either.

By: cyngon

cyngon — Tue, 30 Nov 1999 00:00:00 +0000

Just wondering: Are either of those techniques affected if you use mod_rewrite and the address they types into the browser isn't necessarily the address they end up at?

By: Matt Wilson

Matt Wilson — Tue, 30 Nov 1999 00:00:00 +0000

I use mod_rewrite heavily, which has a similar effect in that you can't trust pathnames (although $_SERVER[PHP_SELF] may still work).

Anyway, my solution is to define a set of variables regarding paths (normally http path and file path, sometimes https), so the only known path necessary is the core included file; everything can use absolute paths using the core include's defined vars. Example:
$path['http'] = /var/www/sitex;
include($path['http'].'/includes/x.php');

By: KillAllDash9

KillAllDash9 — Tue, 30 Nov 1999 00:00:00 +0000

It's not super elegant, but you could start every script with:

if (!defined('MAIN_EXEC_DIR')) define('MAIN_EXEC_DIR', dirname(__FILE__));

Then MAIN_EXEC_DIR would always contain the information you are looking for. Certainly, it's a pain to have to put this in every file, though.

Another option is to actually make use of the include_path INI setting, which can also be altered at run time via ini_set().

By: cagrET

cagrET — Tue, 30 Nov 1999 00:00:00 +0000

I don't have php as cgi so cannot test it, but maybe this will work (only PHP 4 >= 4.3.0, PHP 5):

By: cagrET

cagrET — Tue, 30 Nov 1999 00:00:00 +0000

Code within WACT then needs to be able to determine where myscript.php is located in the filesystem, so that a users templates, for example, can be located relative to myscript.php's path.

Btw.
Why do you need $_SERVER['PATH_TRANSLATED'] for this ?
If the script is called like this: http://domain.foo/some/myscript.php, template is here: /some/templates/example.tpl, relative path to template: 'templates/example.tpl', why can't you just do: require 'templates/example.tpl' ?

Or maybe this:

require $_SERVER['DOCUMENT_ROOT'] . dirname($_SERVER['PHP_SELF']) . "/templates/example.tpl";

By: Demian Turner

Demian Turner — Tue, 30 Nov 1999 00:00:00 +0000

Perhaps this is helpful – Seagull dynamically determines the the script location on the filesystem and the web root of the calling URL. To do this each page execution first loads an init file:

http://muse23.com/cgi-bin/cvsweb.cgi/seagull/init.php?rev=1.84&content-type=text/x-cvsweb-markup

cheers

Demian

By: HarryF

HarryF — Tue, 30 Nov 1999 00:00:00 +0000

[QUOTE=cyngon]Just wondering: Are either of those techniques affected if you use mod_rewrite and the address they types into the browser isn't necessarily the address they end up at?[/QUOTE]

Good question. Not sure. Will explore that shortly.

By: HarryF

HarryF — Tue, 30 Nov 1999 00:00:00 +0000

if (!defined('MAIN_EXEC_DIR')) define('MAIN_EXEC_DIR', dirname(__FILE__));

I guess that will be the last resort. Would be a shame because it requires WACT users to define it (nice when it could happen automatically).

Good point. OK it's PHP 4.3.0 only but perhaps we can use that inside some code which makes various guesses (using SCRIPT_FILENAME, PATH_TRANSLATED and any thing that might be useable).

why can't you just do: require 'templates/example.tpl' ?

That may be an option to explore. We need the path for various file operations (e.g. writing a "compiled" template script) but fopen also supports using the include_path - good point.

$_SERVER['DOCUMENT_ROOT'] . dirname($_SERVER['PHP_SELF'])

Possibly - think those are also somewhat subject to the PHP SAPI you're using but may be useful if we're doing some sort of detection.