Deleting files in higher directory

Question

I'm having problems deleting a file from a higher directory, I found this post and tried it but no luck....:

gotdalife at gmail dot com 25-Sep-2008 02:04

To anyone who's had a problem with the permissions denied error, it's sometimes caused when you try to delete a file that's in a folder higher in the hierarchy to your working directory (i.e. when trying to delete a path that starts with "../").

So to work around this problem, you can use chdir() to change the working directory to the folder where the file you want to unlink is located.

<?php
>     $old = getcwd(); // Save the current directory
>     chdir($path_to_file);
>     unlink($filename);
>     chdir($old); // Restore the old working directory     ?>

here is the code that I currently have:

session_start();

if (!isset($_SESSION['agent']) OR ($_SESSION['agent'] !=md5($_SERVER['HTTP_USER_AGENT']))){

    require_once ('includes/login_functions.inc.php');
    $url = absolute_url();
    header("Location: $url");
    exit();
}  



$folder = $_GET['folder'];
$filename = $_GET['name'];
$path = "../gallery/photos/$folder";

if (isset($_POST['submitted'])) {

    if ($_POST['sure'] == 'Yes') {  

        $old = getcwd(); // Save the current directory
        chdir($path);
        unlink($filename);
        chdir($old); // Restore the old working directory  

    }
    else{

        echo '<p>The photo has NOT been deleted.</p>';
    }
}

I'm getting the error message :

Warning: unlink() [function.unlink]: No error in J:\xampp\htdocs\bunker\admin\delete_file.php on line 37

line 37 being:

unlink($filename);

can anybody see what I've done wrong?

Answer 1

I always use absolute filepath names.

I'd define the filedir as a constant in your config, then concatenate so you have an absolute filepath, then make a call to unlink().

Btw: I hope you know your code is highly insecure.

Answer 2

See here:

http://bugs.php.net/bug.php?id=43511

and here

http://php.bigresource.com/Track-php-03TimDKO/

http://www.phpbuilder.com/board/showthread.php?t=10357994

Though I wouldnt recommend doing this, as per the comments above. Is there the option for a different approach?