Same name and namespace in other branches
  1. 4.6.x includes/file.inc \file_check_location()
  2. 4.7.x includes/file.inc \file_check_location()
  3. 5.x includes/file.inc \file_check_location()

Check if a file is really located inside $directory. Should be used to make sure a file specified is really located within the directory to prevent exploits.

// Returns FALSE:
file_check_location('/www/example.com/files/../../../etc/passwd', '/www/example.com/files');

Parameters

$source A string set to the file to check.:

$directory A string where the file should be located.:

Return value

0 for invalid path or the real path of the source.

Related topics

File

includes/file.inc, line 252
API for handling file uploads and server file management.

Code

function file_check_location($source, $directory = '') {
  $check = realpath($source);
  if ($check) {
    $source = $check;
  }
  else {

    // This file does not yet exist
    $source = realpath(dirname($source)) . '/' . basename($source);
  }
  $directory = realpath($directory);
  if ($directory && strpos($source, $directory) !== 0) {
    return 0;
  }
  return $source;
}