Ordering files in a directory

[BrightStar]

Hi, I hope you can help resolve what I'm sure is a relatively simple problem.

 

I am trying to code a simple image gallery for my website. 

 

Basically, what the script does is get all files in a directory and output them as images.  To keep the layout neat, I have arranged my output into a table, using a $cols value to sort how many entires are displayed per row.

 

My code looks like this:

 

$cols = 3; // columns number

// DO NOT EDIT BELOW

$i =1;
$files = array ();

$myDirectory = opendir("$cat");
echo "<table width='100%' border='0' cellpadding='5' cellspacing='10'><tr>";

	while ($file = readdir($myDirectory)) 
	{

	 	if (($file != ".") && ($file != "..") && ($file != "sprites.php") && !(is_dir("$cat/$file")) )
		{
    		$files[] = $file;

			if (is_int($i / $cols)) 
			{
			list($width, $height) = getimagesize("$cat/$file");   
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$cat/$file' border='0'>";
			echo "<BR><b>$file</b></font></td></tr><tr>";
			}
			else
			{
			list($width, $height, $type, $attr) = getimagesize("$cat/$file");   
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$cat/$file' border='0'>";
			echo "<BR><b>$file</b></font></td>";
			}
			$i++;
		}
	}

echo "</tr></table>";
closedir($myDirectory);


?>

 

($cat = the path to the directory of my images.)

 

Everything outputs okay, but the problem I am hoping someone here can help me with is that the order is all wrong. 

 

I want the images to be listed in alphabetical order, according to their filename.  I read that I can use the sort() function, but it doesn't seem to work. 

 

I'm not too sure what I must be doing wrong, so I was wondering if someone here would be kind enough to help ease my headache and tell me what I need to make the script output the files in order of filename.

 

Thank you.

[gffg4574fghsDSGDGKJYM]

You have to read all the filelist then sort them, then display them.

 

You can't read 1 filename then display it, then read next, you won't be able to sort them with that.

 

This is a example how to do it :

<?php

$filelist = glob("*");
sort($filelist);

foreach($filelist as $filename)
{
   echo $filename."<br>";
}

?>

[BrightStar]

Thanks, theonlydrayk.

 

This is my code now:

 

$cols = 3; // columns number
$i =1;

$myDirectory = opendir("$cat");
echo "<table width='100%' border='0' cellpadding='5' cellspacing='10'><tr>";

	$filelist = glob("$cat/*");
	sort($filelist);

		foreach($filelist as $filename)
		{		
			if (is_int($i / $cols)) 
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'>";
			echo "<BR><b>$filename</b></font></td></tr><tr>";
			}
			else
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'>";
			echo "<BR><b>$filename</b></font></td>";
			}
			$i++;

	   
		}


echo "</tr></table>";
closedir($myDirectory);

 

The good news is that it's now listing all my files alphabetically, which is great.  Thank you so much.

 

I was wondering, are there any particular security issues I should be concerned about with my code being as it is?  I was worried that someone could easily change my url (e.g:  http://www.site.com/gallery/images.php?cat=me ) and potentially view files in ANY directory on the server.

 

Is this possible, or should it be only able to display images that are relative to the directory where my script is stored?

 

E.g:  if my script is stored at www/site/public_html/gallery/ then only directories in the gallery folder would be able to be accessed.

 

 

[gffg4574fghsDSGDGKJYM]

Yeah it can be a security issue. Only accept directory that are know and safe, exclude everything else.

 

$validdirectory = array('jpg', 'thumb', 'png');
if (!(in_array($_GET['cat'], $validdirectory)))
{
  /* echo error message or redirect to 404 */
  die();
}

 

And btw you don't need these anymore :

$myDirectory = opendir("$cat");
...
closedir($myDirectory);

[BrightStar]

Thanks again, theonlydrayk.   

 

The code snippet you posted:

 

$validdirectory = array('jpg', 'thumb', 'png');
if (!(in_array($_GET['cat'], $validdirectory)))
{
  /* echo error message or redirect to 404 */
  die();
}

 

doesn't seem to work.  Well, it works---problem is, it's stopping me from accessing a directory that I want it to access. 

 

Here is my code now:

 

/$validdirectory = array('jpg', 'thumb', 'png');
	if (!(in_array($_GET['cat'], $validdirectory)))
	{
	echo "Incorrect Use"; 
  		die();
	}

$cols = 3; // columns number
$i =1;

echo "<table width='100%' border='0' cellpadding='5' cellspacing='10'><tr>";

	$filelist = glob("$cat/*");
	sort($filelist);

		foreach($filelist as $filename)
		{		

			if (is_int($i / $cols)) 
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'></td></tr><tr>";
			}
			else
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'></td>";
			}
			$i++;

	   
		}

 

Did I maybe just put your code fragment in the wrong place?  I tried a couple of other places, but it's not helping things.

 

Any ideas?  I'm puzzled.

 

[Daniel0]

You'll obviously have to modify the array to whitelist the directories you want.

[BrightStar]

Oh, whoops!  I see what I was doing wrong.  I'd forgotten that my $cat variable only includes the files path, not it's actual name.  Silly me, sorry.  I'd been thinking that it should be working because I thought it would find "gif" and "jpeg" in my file extensions and know to allow them.

 

Here is my newly revised code:

 

list($dir1, $dir2) = split('/', $cat);
	$validdirectory = array('chapters', 'demo', 'gifs', 'movies' );
	if (!(in_array($dir1, $validdirectory)))
	{
	echo "Incorrect Use"; 
  		die();
	}

$cols = 3; // columns number
$i =1;

echo "<table width='100%' border='0' cellpadding='5' cellspacing='10'><tr>";

	$filelist = glob("$cat/*");
	sort($filelist);

		foreach($filelist as $filename)
		{		
		list($dir1, $dir2, $name) = split('[/-]', $filename);
			if (is_int($i / $cols)) 
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'><br><b>$name</b></td></tr><tr>";
			}
			else
			{
			echo "<td bgcolor=#000044 align='center'><font size='-2'><img src='$filename' border='0'><br><b>$name</b></td>";
			}
			$i++;

	   
		}


echo "</tr></table>";
}

 

Seems to be working with no problems now, thank you.