I'm currently developing a CGI script that will allow clients to browse a directory tree of files and stuff that will be posted on a webserver. Users will be able to see the contents of the current directory and will be able to browse to other directories within the tree (with some bonus features like custom file descriptions). Of course I would like to prevent users from "accidentally" browsing into directories that they shouldn't have access to (like the directory trees of other clients). I think the server currently does user authentication by directory using .htaccess files. Not every directory has one of these files, subdirectories inherit the properties of the parent. I want to avoid creating more than one script per client, thus I think I need the script to handle user authentication for each request to browse a particular directory. Any suggestions for how to check that the user isn't wandering around my entire filesystem? (sorry no code yet, still in design phase) Thanks.