ls.php

<?php

/*
 due to the open_basedir restriction, $tgtPath must be something like the following path param:
    http://<your domain>.aws.af.cm/ls.php?path=/var/vcap.local/dea/apps/f-0-21341234123412abcdefgc75cc0f96b9/app/

 to discover what are the allowed paths, try supplying any path, e.g. '/' then view the error logs via:
    af logs <your app name>
*/

$tgtPath = '';
$catIt = '';

foreach ($_GET as $key=>$value) {
    if ($key == "path")
        $tgtPath= urldecode($value);
    else if ($key == "cat")
        $catIt = urldecode($value);
}

$curPath = getcwd();

if ($catIt == "1")
{
    if (is_file( $tgtPath))
    {
        $file = $tgtPath;

        header('Content-Description: File Transfer');
        //header('Content-Type: application/pdf');
        header('Content-Length: ' . filesize($file));

        // to open in browser
        //header('Content-Disposition: inline; filename=' . basename($file));

        // to download
        header('Content-Disposition: attachment; filename=' . basename($file));

        readfile($file); /* or use include($file); */
    }
    else
        echo "<div>$tgtPath is not a readable file";
}
else if ($handle = opendir($tgtPath)) {
    echo "<p>Input path: $tgtPath</p>\n";
    echo "<p>Current path: $curPath</p>\n";
    
    if (is_dir( $tgtPath))
    {
        echo "<h3>Content</h3>\n";    
        
        /* This is the correct way to loop over the directory. */
        while (false !== ($entry = readdir($handle))) {
            if ($entry != "." && $entry != "..") 
            {
                $path = $tgtPath . $entry;
                if (is_dir( $path ))
                {
                    $path = $path . DIRECTORY_SEPARATOR;
                    echo "<div><a href=\"ls.php?path=$path\">$entry</a></div>\n";
                }
                else
                    echo "<div><a href=\"ls.php?cat=1&path=$path\">$entry</a></div>\n";
            }
        }

        closedir($handle);
    }
    else
        echo "<div>$tgtPath is not a directory";
    
}