[dokuwiki] security problems with glob()
- From: "YC Chan" <peter.chan.yc@xxxxxxxxx>
- To: dokuwiki@xxxxxxxxxxxxx
- Date: Wed, 12 Sep 2007 13:57:33 +0200
Hi,
glob is used in the standard plugin config: file:settings\extra.class.php;
so it concerns everybody.
http://seclists.org/fulldisclosure/2005/Sep/0001.html
describes security reasons for which glob is disabled on certain Internet
Supplier Servers.
In particular, on Free.fr, there will be a warning like 'sort function
expects an array as first argument, given a string'.
Looks like a bug. No, its due to security restrictions to that variable
which is obtained by glob.
However there is a work-around which works very well. see: function
safe_glob in
http://fr.php.net/manual/en/function.glob.php
I suggest integrating this version of safe_glob to do away with apparent
bugs on a system that works well otherwise,
even on paranoid servers !
FYI: author: BigueNique at yahoo dot ca
function safe_glob($pattern, $flags=0) {
$split=explode('/',$pattern);
$match=array_pop($split);
$path=implode('/',$split);
if (($dir=opendir($path))!==false) {
$glob=array();
while(($file=readdir($dir))!==false) {
if (fnmatch($match,$file)) {
if ((is_dir("$path/$file"))||(!($flags&GLOB_ONLYDIR))) {
if ($flags&GLOB_MARK) $file.='/';
$glob[]=$file;
}
}
}
closedir($dir);
if (!($flags&GLOB_NOSORT)) sort($glob);
return $glob;
} else {
return false;
}
}
Other related posts:
- » [dokuwiki] security problems with glob()