沒有符號鏈接解析的絕對路徑/將用戶保存在主目錄中

Question

在PHP中如何確定給定相對路徑的絕對路徑而不實際解析符號鏈接？類似於realpath函數，但沒有符號鏈接分辨率。

或者，有沒有一些簡單的方法來檢查用戶（誰使用我的瀏覽PHP腳本來查看文件）是否沒有意外退出Apache虛擬主機的主目錄？ （或不允許他使用討厭的和..在路徑中）

謝謝！

Answer 1

我不知道這個PHP自身的解決方案，但一個不錯的絕對路徑的實現是在這裏：http://www.php.net/manual/en/function.realpath.php#84012

Answer 2

您可以使用open_basedir設置ini php.ini或虛擬主機聲明（如php_admin_value指令）。

Answer 3

，這裏是我的方法模仿原realpath()也：

1. 再添/刪除的Win​​dows如c:中的驅動器號。
2. 刪除尾部斜線。
3. 將當前工作目錄預加到相對路徑。
4. 可選擇檢查文件是否存在。如果存在不存在的文件A）什麼也不做，B）返回一個FALSE值或C）拋出一個錯誤。
5. （可選）遵循符號鏈接。

注意：此方法使用已知CPU昂貴的正則表達式，所以我喜歡使用http://www.php.net/manual/en/function.realpath.php#84012的數組的方法。

// Set constants for when a file does not exist. 
// 0: Check file existence, set FALSE when file not exists. 
define('FILE_EXISTENCE_CHECK', 0); 
// 1: Require file existence, throw error when file not exists. 
define('FILE_EXISTENCE_CHECK_REQUIRE_FILE', 1); 
// 2: Do not check file existence. 
define('FILE_EXISTENCE_CHECK_SKIP', 2); 
// Windows flag. 
define('IS_WINDOWS', preg_match('#WIN(DOWS|\d+|_?NT)#i', PHP_OS)); 
// Directory separator shortcuts. 
define('DIR_SEP', DIRECTORY_SEPARATOR); 
define('PREG_DIR_SEP', preg_quote(DIR_SEP)); 

/** 
* The original realpath() follows symbolic links which makes it harder to check 
* their paths. 
* 
* Options 
* file_existence_check: 
* - FILE_EXISTENCE_CHECK_REQUIRE_FILE: Script will break if the checked 
*  file does not exist (default). 
* - FILE_EXISTENCE_CHECK: If a file does not exist, a FALSE value will be 
*  returned. 
* - FILE_EXISTENCE_CHECK_SKIP: File existence will not be checked at all. 
* 
* follow_link: Resolve a symbolic link or not (default: FALSE). 
*/ 
function _realpath($path = NULL, $options = array()) { 
    // Merge default options with user options. 
    $options = array_merge(array(
    'file_existence_check' => FILE_EXISTENCE_CHECK_REQUIRE_FILE, 
    'follow_link' => FALSE, 
), $options); 

    // Use current working directory if path has not been defined. 
    $path = $path ? $path : getcwd(); 
    // Replace slashes with OS specific slashes. 
    $path = preg_replace('#[\\\/]#', DIR_SEP, $path); 

    // Handle `./`. Another great approach using arrays can be found at: 
    // @link p://php.net/manual/en/function.realpath.php#84012 
    $path = preg_replace('#' . PREG_DIR_SEP . '(\.?' . PREG_DIR_SEP . ')+#', DIR_SEP, $path); 
    // Handle `../`. 
    while (preg_match('#^(.*?)' . PREG_DIR_SEP . '[^' . PREG_DIR_SEP . ']+' . PREG_DIR_SEP . '\.\.($|' . PREG_DIR_SEP . '.*)#', $path, $m)) { 
    $path = $m[1] . $m[2]; 
    } 
    // Remove trailing slash. 
    $path = rtrim($path, DIR_SEP); 

    // If we are on Windows. 
    if (IS_WINDOWS) { 
    // If path starts with a lowercase drive letter. 
    if (preg_match('#^([a-z]:)(.*)#', $path, $m)) { 
     $path = strtoupper($m[1]) . $m[2]; 
    } 
    // If path starts with a slash instead of a drive letter. 
    elseif ($path[0] === DIR_SEP) { 
     // Add current working directory's drive letter, ie. "D:". 
     $path = substr(getcwd(), 0, 2) . $path; 
    } 
    } 
    else { 
    // Remove drive letter. 
    if (preg_match('#^[A-Z]:(' . PREG_DIR_SEP . '.*)#i', $path, $m)) { 
     $path = $m[1]; 
    } 
    } 

    // If path is relative. 
    if (!preg_match('#^([A-Z]:)?' . PREG_DIR_SEP . '#', $path)) { 
    // Add current working directory to path. 
    $path = getcwd() . DIR_SEP . $path; 
    } 

    // If file existence has to be checked and file does not exist. 
    if ($options['file_existence_check'] !== DSC_FILE_EXISTENCE_CHECK_SKIP && !file_exists($path)) { 
    // Return FALSE value. 
    if ($options['file_existence_check'] === DSC_FILE_EXISTENCE_CHECK) { 
     return FALSE; 
    } 
    // Or throw error. 
    else { 
     dsc_print_error('File does not exist: ' . $path); 
    } 
    } 

    // Follow sybmolic links, but only if the file exists. 
    if (!empty($options['follow_link']) && file_exists($path)) { 
    $path = readlink($path); 
    } 

    return $path; 
}