Question

I’ve searched other questions but can’t find a workable solution. This is a CMS program, I’ve tried to upload files to any directory and am getting the following the error:

Warning: preg_replace() [function.preg-replace]: Compilation failed: nothing to repeat at offset 3 in /home/...on line 1017 

Here is the code, any suggestions?:

function _IsValidPath($Path)
{ // First check if the path starts with the starting directory     
$basePath = preg_replace("/{1,}/", "/", $_SESSION['rootdirectory'] . '/' . // this line (1017) causing the error
 $_SESSION["startingdirectory"]);
$sdPos = strpos($basePath, $Path);
if (!is_numeric($sdPos))
        {
            $sdPos = strpos($Path, $basePath);
        }

        if(is_numeric($sdPos) && $sdPos == 0)
        {
            // Make sure it doesn't contain any invalid characters
            if(is_numeric(strpos($Path, "..")) ||
            (is_numeric(strpos($Path, "./"))) ||
            (is_numeric(strpos($Path, "//"))) ||
            (is_numeric(strpos($Path, "\\"))) ||
            (is_numeric(strpos($Path, "../"))) ||
            (is_numeric(strpos($Path, "&"))) ||
            (is_numeric(strpos($Path, "*"))) ||
            (is_numeric(strpos($Path, " "))) ||
            (is_numeric(strpos($Path, "'"))) ||
            (is_numeric(strpos($Path, "\?"))) ||
            (is_numeric(strpos($Path,"<"))) ||
            (is_numeric(strpos($Path, ">"))))
            {
                return false;
            }
            else
            {
                // The path is OK
                return true;
            }
        }
        else
        {
            return false;
        }
    }

Answer 1

Change it to:

$basePath = preg_replace("@/{1,}/@", "/", $_SESSION['rootdirectory'] . '/' .
 $_SESSION["startingdirectory"]);

preg_replace expects the regular expression to be delimited by a character inside the string so that you can specify flags like g or i afterwards (I usually use @). It was treating / as the delimiter. See the preg_replace manual page for more info.

Even still, this code doesn’t make much sense, and there is probably a much better way to accomplish what it is supposed to do.