php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #43407 glob() returns false if directory not exist and safe-mode / open_basedir is on
Submitted: 2007-11-26 09:26 UTC Modified: 2007-11-26 20:09 UTC
From: ppalka7 at abacus dot pl Assigned: iliaa (profile)
Status: Not a bug Package: Filesystem function related
PHP Version: 5.2.5 OS: CENTOS Ent 5 i686 2.6.18-8.1.8.e
Private report: No CVE-ID: None
View Developer Edit
 [2007-11-26 09:26 UTC] ppalka7 at abacus dot pl 
Description:
------------
Glob return incorect types values if directory not exists

Reproduce code:
---------------
$arr=glob('directory/not/exists/*.jpg');


echo 'Is array-'.is_array($arr).'<br />';
echo 'Sizeof-'.sizeof($arr).'<br />';

echo '<pre>';
print_r($arr);
echo '</pre>';


foreach($arr as $key => $val)
{
	echo $val;
}

Expected result:
----------------
php 5.2.4

Is array-1
Sizeof-0

Array
(
)


Actual result:
--------------
php 5.2.5

Is array-
Sizeof-1


Warning: Invalid argument supplied for foreach() in /home/projekt5/public_html/phpbug/glob.php on line 14

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-26 10:39 UTC] jani@php.net 
There's some error happening and as documented, this function returns FALSE then. Do you have open_basedir / safe_mode enabled?
 [2007-11-26 10:55 UTC] ppalka7 at abacus dot pl 
On affected system

phpinfo();

open_basedir	/home/projekt5/:/usr/lib/php:/usr/local/lib/php:/tmp	no value

safe_mode	Off	On
 [2007-11-26 11:06 UTC] jani@php.net 
Ilia, shouldn't this return an empty array in case of open_basedir / safe_mode being on as it does when they're NOT on? A bit inconsistency here..
 [2007-11-26 20:09 UTC] iliaa@php.net 
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

No it should not because that allows glob() open_basedir/safe_mode 
bypass by allowing the user to determine that the directory/file exist. 
We specifically return FALSE so you cannot tell if the data exists on 
disk or not.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Nov 20 06:00:01 2025 UTC