How to add an index file to all subdirectories

[beary]

Hello all,

I've done something a bit stupid and am hoping some kind soul out there can help me out.

There's a piece of code that goes through and creates a high number of subdirectories within subdirectories, which is fine. Initially I forgot to create an index.html file in each directory to prevent viewing of its folders and files without people being logged in. I've fixed it now, but there are a whole heap of directories without this file.

Is there some piece of code which, if I specify the top directory, will go through and add the index file?

I have the code the add the file. I'm stuck on getting the code to go through all subdirectories within subdirectories etc. Here's what I have so far:

<?php
function addindex($dir)
{
if ($handle = opendir($dir))
{
    while (false !== ($file = readdir($handle))) {
        if ($file != "." && $file != "..") {
 
            if(is_dir($dir.$file))
            {
                    $indexfile = $dir.$file."/index.html";
                    $filehandle = fopen($indexfile, 'w') or die("can't open file");
                    fclose($filehandle);
            }
        }
    }
    closedir($handle);
}
}
addindex('mydir/');
?>

[dlite922]

This is now how you protect your directories. An index.html file just gives them something to see. If I really wanted to see what's in the directory, I'd have no problem accessing it.

use a .htaccess file if your running Apache, or don't put the directories under the site directory, put them elsewhere.




Dan

[beary]

Hey Dan,

Thanks for the reply.

@dlite922
The point is that if someone works out the user's directory, and they enter that path into the address bar of the browser, all they'll see is a blank file, not the listing of folders and files. Surely having the index.html file in there will accomplish this?

Can you please expand on how you could access the files in a directory.

use a .htaccess file if your running Apache, or don't put the directories under the site directory, put them elsewhere. Dan

I don't think this solution will work as it's possible for there to be subdirectories within subdirectories within subdirectories.

Anyway, I'm still interested in how to do something to every subfolder in a particular directory, whether it's adding an index file or doing something else.

[dlite922]

@beary
There are some crawler type software that do it. I have not used it, but one method would be direct access to the file if I guess or know the file name I'm looking for.

I'm just saying if there is sensitive data in there that you need protected, this is not a way to do it. If it doesn't really matter if a hacker has the files, then this could work for the average user. I still don't understand why you would want folders that are not public be on a public site.

You can control access via a .htaccess:

RewriteRule ^includes /this.file.does. not.exist
RewriteRule ^errors /this.file.does. not.exist


The URL i gave you does show you have a recursion can be used to traverse a directory tree.





Dan

[beary]

@dlite922
Ok, let me try to give more detail:

It's a site run at my workplace (which happens to be a school). It's hosted on a web share on the school's domain name, which means the main school website is publicly accessible. My site lives on a web share which is a subdirectory of the main site.

To access this site, users (in this case, teachers or students) must enter their username or password. Without that, it won't log them in. The structure goes

teachuser/class/students/studusername/

eg. jenkins/9_maths/students/citizen_john

The student John Citizen can access anything in his folder, and theoretically other students can't. But John Citizen works out that since his folder path is jenkins/9_maths/students/citizen_john, then his classmate's path must be jenkins/9_maths/students/jones_mary and he enters that in the browser and it shows all her files. Not so good.

But with an index file, it'll only show a blank page to John, not her files. This seems to achieve that goal, however...

If I don't log in at all, and then type in jenkins/9_maths/students/citizen_john I get the standard directory layout. I realise this is a potentially big problem, for security and privacy issues.

So I guess my aim is this: there are multiple teachers using the site. For each teacher, there are multiple classes. For each class, there are teacher-uploaded files and also a folder called students. In that folder are the folders for each student in the class. In each of those folders are student files

Eg. Teacher Jenkins teaches a Maths class with 3 students. His folders are

jenkins/
jenkins/maths/ [in this folder there are normal files and possibly other folders]
jenkins/maths/students/
jenkins/maths/students/blunt_billy/
jenkins/maths/students/jones_mary/
jenkins/maths/students/citizen_john/

and in each of the above 3 folders there will be files.

Basically every folder and file under jenkins/ needs to be somehow protected. I fear this won't make too much sense, but assuming it does, what do you suggest?

[dlite922]

Wow, big project. In your case, the index file does you no good.

if i'm citizen john, how does it know i'm citizen john? are you going to code every index file to check a session variable against a static string or the parent folder name?

You really should be doing this in a database. This needs to be a secure application since there could be hundreds of students, it's not feasible to hand manage each of their folders.

You need a database that has a list of all teachers, students and classes. Then a table that matches the three:

teacherID, studentID, classID

where each is the corresponding foreign key to the three tables. Going back to the reason you're doing folders, you want the students and teachers to save files to these locations?

if so you can have a file table. Each file is attached to a student or teacher ID. the file itself could be uploaded and saved in a folder that has the user (student or teacher) ID as the name, or perhaps the firstName and lastName of the owner. This directory does not have to be "deep", only one or two subdirectory since it is assumed no student can have the same ID (no teacher with the same ID), so there won't be a conflict.

How it would work:

Once a student logs in, it will see the classes that he is enrolled in. he clicks on a class and sees the list of files he has. He can click on a file to download it or use the upload file feature to add a file. (you can also record time uploaded for teacher's use)

If a teacher logs in, it will see the classes he or she is teaching. Clicking on a class gives the list of students in the class (perhaps you can allow the teacher to store a grade or grade per assignment functionality as well). If a student name is clicked, the teacher will see the same files the student does.

This is a portal and you could build your own simple one, or you could just buy one that does much more than manage files. I currently use a portal for college that lets me interact on a forum, see my assignments, my grades for each of those. content and files teacher has upload as well as files that I have uploaded for grading.

myCampus






Dan

[beary]

@dlite922
He he! It already does all of what you've mentioned below and far more. It's a completely database (mysql) driven site. The db has 38 tables, and it's all normalised. Everything has been meticulously thought out and constructed so there's no duplication in the tables and the code I have written works incredibly well. It's quick; it does exactly what I need it to do. But you're right, it is a big project, which is why so far I've probably spent over 500 hours of my own time on it.

if i'm citizen john, how does it know i'm citizen john? are you going to code every index file to check a session variable against a static string or the parent folder name?

Of course not. When the user logs in, his username, password etc is stored as a session variable. Those variables are available to every page. It knows you're John Citizen because you logged in as John Citizen and your unique username and password as stored as session variables. All this happens in 1 file which is included on any other file I want. Believe me, it works...

You really should be doing this in a database..SNIP. ..

See 1st paragraph.

Going back to the reason you're doing folders, you want the students and teachers to save files to these locations?

Yes. They can already do that as required. Students can save files to their own folder (and only their own folder) and any teacher of that student can see the files of any students in their own class, but no students who aren't in their class.

How it would work:

Once a student logs in, it will see the classes that he is enrolled in. he clicks on a class and sees the list of files he has. He can click on a file to download it or use the upload file feature to add a file. (you can also record time uploaded for teacher's use)

If a teacher logs in, it will see the classes he or she is teaching. Clicking on a class gives the list of students in the class (perhaps you can allow the teacher to store a grade or grade per assignment functionality as well). If a student name is clicked, the teacher will see the same files the student does.

Believe me, it does exactly this plus about another hundred things. It's been completely thought through.

This is a portal and you could build your own simple one, or you could just buy one that does much more than manage files.
Dan

As I've said, I have built one, and it's far from simple.

The last thing I want is for all these responses to come across as if I'm being arrogant about it all. But there's been an awful lot of time, thought and effort put into this. I'm not a newbie :) The site is completely functional. Ie. it does exactly what I wanted it to do when I set out to make it.

But the fact that it's functional doesn't guarantee its security. And that's where I need the advice of others re security and privacy. I like structure and organisation and I think the directory structure that I described is clear and logical. You've alerted me to the fact that having an index file won't help, which I appreciate. now I need to know ways of making those directories secure. Again, thanks for your conversation so far. I hope it continues.

[Markus]

So you want to go through every folder under a certain directory and insert an index file? OK, recursion is what you're looking for. Google will give you many recursive tutorials - then you just need to (in the function) check for an index file, if it's not there, create one.

Here's a good tutorial - scroll down for the folder recursion.

[beary]

@Markus
Markus,

Thanks heaps for this solution to my original question.

Cheers

[Markus]

@beary
No problamo.

See you around,
Markus.