|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2013-08-21 06:41 UTC] ab@php.net
[2022-08-02 17:37 UTC] git@php.net
[2022-08-02 17:37 UTC] git@php.net
-Status: Open
+Status: Closed
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Oct 27 03:00:02 2025 UTC |
Description: ------------ As documentation states "Returns an array containing the matched files/directories, an empty array if no file matched or FALSE on error." whereby in case when internal glob() has returned NOMATCH, there's no reliable way to do basedir check. As examples below illustrate, when the glob query is complex, glob() returned NOMATCH and query is valid within basedir, it still will return bool(false) to the userspace in the most cases. If the result is empty, using php_check_open_basedir_ex() on the pattern will work "somehow" only if it's a direct filesystem path or close to it, so generally such check is senseless. Therefore what documentation states about returning an empty array vs. false cannot be guaranteed. The same misbehavior persists on windows with correspondingly modified queries. Test script: --------------- <?php ini_set("open_basedir", "/etc"); /* found */ var_dump(glob("/etc")); /* found given you're on debian :) */ var_dump(glob("/???/issue")); /* basedir restriction */ var_dump(glob("/usr")); /* basedir restriction, but that's a random result. PHP doesnot really check /usr/nonono and /etc/nonono against basedir */ var_dump(glob("/{usr,etc}/nonono", GLOB_BRACE)); /* erroneous basedir restriction */ var_dump(glob("/[e]??/hey")); /* erroroneous basedir restriction */ var_dump(glob("/???/absent")); Expected result: ---------------- array(1) { [0]=> string(4) "/etc" } array(1) { [0]=> string(10) "/etc/issue" } bool(false) bool(false) array(0) { } array(0) { } Actual result: -------------- array(1) { [0]=> string(4) "/etc" } array(1) { [0]=> string(10) "/etc/issue" } bool(false) bool(false) bool(false) bool(false)