--- dir.c.orig 2006-10-05 02:30:56.000000000 +0200 +++ dir.c 2006-12-22 22:27:16.000000000 +0100 @@ -419,18 +419,19 @@ return; } - /* we assume that any glob pattern will match files from one directory only - so checking the dirname of the first match should be sufficient */ - strncpy(cwd, globbuf.gl_pathv[0], MAXPATHLEN); - if (PG(safe_mode) && (!php_checkuid(cwd, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { - RETURN_FALSE; - } - if (php_check_open_basedir(cwd TSRMLS_CC)) { - RETURN_FALSE; - } array_init(return_value); for (n = 0; n < globbuf.gl_pathc; n++) { + + /* Check for every single file if it violates safe_mode or open_basedir + restrictions. In case of a violation do not warn and do not return + it in the result array */ + if (PG(safe_mode) && (!php_checkuid_ex(globbuf.gl_pathv[n], NULL, CHECKUID_CHECK_FILE_AND_DIR, CHECKUID_NO_ERRORS))) { + continue; + } + if (php_check_open_basedir_ex(globbuf.gl_pathv[n], 0 TSRMLS_CC)) { + continue; + } /* we need to do this everytime since GLOB_ONLYDIR does not guarantee that * all directories will be filtered. GNU libc documentation states the * following: