how to protect url string which is created by GET in php - php

Question

for a filemanagement i want to make an anchor for scanning a specific directory.
I use this echo for it:
echo "<div class='urldir'>"
."<a href='?dir=".dirname($dir).'/'.basename($dir).'/'.$file."'>open dir</a>"
."</div>";
The dirname and basename give me the the right path to the directory.
this is the normal "root" directory for the users:
$dir = 'uploads/sfm/'.$UserID;
When i user created a folder in his root, he must be able to see the files in that folder.To change the directory and show all the files in that directory, i use this
$actual_link = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$strArr = explode("=",$actual_link);
$CurrentPath = $strArr[1];
if(isset($_GET['dir'])) {
$dir = $CurrentPath;
}
So i read the dir from the url and the variable $dir changes
The problem: the url shows me a string like this:
sfm?dir=uploads/sfm/c4ca4238a0b923820dcc509a6f75849b/folder
When i type now in the url:
sfm?dir=uploads/
he shows me the files in uploads folder. This must be protected!
Nobody should be able to see this.
And also this must be protected from view:
sfm?dir=uploads/sfm/
How can i achieve that?
By the way: the hash in the url is because i have the var $UserID md5 hashed
md5($UserID)

Answer 1

$protectedDirectories = array(
array( 'uploads', 'sfm', $userId )
);
$directory = str_replace('\\','',$_GET['dir']);
$directory = trim($directory,'/');
$directory = preg_replace('#[\/]{1,}#','/',$directory);
$stats = false; // True = Protected , False = Cannot enter this directory.
$seperate = explode('/',$directory);
$cntSeperate = count( $seperate );
foreach($protectedDirectories as $pattern ){
if( count( $pattern ) > $cntSeperate ){
continue;
}
$innerStats = true;
foreach( $pattern as $key => $val ){
if( $seperate[ $key ] !== $val ){
$innerStats = false;
break;
}
}
if( $innerStats == false ){
continue;
}
$stats = true;
break;
}
if( $stats == true ){
// Access Granted
}else{
// Access Not Granted
}
Now you can dynamically use your directory access grants. Each array means a pattern. Each array's value is a directory inside directories ( For example : array('uploads', 'sfm') means uploads/sfm )

Answer 2

A sample solution is to grab the md5 directory using a regular expression.
Something like this:
$res = preg_match('/uploads\/sfm\/([a-f0-9]{32}).*/', $dir, $matches);
if (!$res || $matches[1] != md5($UserID)) {
// user requested a directory he has no access to. Take additional
// actions, e.g. return HTTP status 403
exit('No access here');
}