[dokuwiki] security problems with glob()

Hi,
glob is used in the standard plugin config: file:settings\extra.class.php;
so it concerns everybody.

http://seclists.org/fulldisclosure/2005/Sep/0001.html
describes security reasons for which glob is disabled on certain Internet
Supplier Servers.
In particular, on Free.fr, there will be a warning like 'sort function
expects an array as first argument, given a string'.
Looks like a bug. No, its due to security restrictions to that variable
which is obtained by glob.

However there is a work-around which works very well. see: function
safe_glob in
http://fr.php.net/manual/en/function.glob.php

I suggest integrating this version of safe_glob to do away with apparent
bugs on a system that works well otherwise,
even on paranoid servers !

FYI: author:  BigueNique at yahoo dot ca
function safe_glob($pattern, $flags=0) {
    $split=explode('/',$pattern);
    $match=array_pop($split);
    $path=implode('/',$split);
    if (($dir=opendir($path))!==false) {
        $glob=array();
        while(($file=readdir($dir))!==false) {
            if (fnmatch($match,$file)) {
                if ((is_dir("$path/$file"))||(!($flags&GLOB_ONLYDIR))) {
                    if ($flags&GLOB_MARK) $file.='/';
                    $glob[]=$file;
                }
            }
        }
        closedir($dir);
        if (!($flags&GLOB_NOSORT)) sort($glob);
        return $glob;
    } else {
        return false;
    }
}

Other related posts: