A client has posted us the following code, after being able to view to complete filesystem on a Windows 2000 server we resell space on:

----------------------------------------------------
<? 
// get directory handle 
$hook = dir("c:winnt"); 

// display location 
echo "<b>Current path is $hook->path</b><br>"; 

// read directory and echo list 
while ($file=$hook->read()) 
{ 
if ($file != "." && $file != "..") 
{ 
echo "$file<br>"; 
} 
} 

// close directory 
$hook->close(); 
?> 
----------------------------------------------------

Is there anyway to protect against this, and does it represent a security flaw?

Thanks

Gary