PHP errors occasionally when running dynmap standalone - potential cause: world names with spaces, double forward slashes in pathnames

Issue Description: Disclaimer: I have little to no PHP experience so I'm pretty lost here and my assumptions could be way off base. I noticed after installing dynmap standalone using Nginx that I would occasionally get a few PHP errors in my error log. I think part of the issue was 3 of my worlds having spaces in their names and I also think that the current code in update.php will add a double // to the $fname variable since the $webpath seems to always add a forward slash at the end when it's created and the code to set $fname adds another slash in front of /standalone.

Dynmap Version: Dynmap version: core=3.1-SNAPSHOT-415, plugin=3.1-SNAPSHOT-415
Server Version: This server is running Paper version git-Paper-204 (MC: 1.16.3) (Implementing API version 1.16.3-R0.1-SNAPSHOT)
Pastebin of Configuration.txt: https://pastebin.com/gdNW2Cwj
Server Host (if applicable): Self Hosted

Pastebin of crashlogs or other relevant logs: Example of error with double forward slashes in path caused by $webpath having one forward slash and the code to create $fname adding a second forward slash with /standalone/updates_ Notice in the error the double forward slash after dynmap/web and before standalone in the very long path. I think I've fixed this for myself by removing the forward slash in front of /standalone/updates on line 31 of updates.php

2020/09/23 00:35:08 [error] 332083#332083: *1404929 FastCGI sent in stderr: "PHP message: PHP Warning:  file(/home/amp/.ampdata/instances/Minecraft03/Minecraft/plugins/dynmap/web//standalone/updates_Cobalt.php): failed to open stream: No such file or directory in /home/amp/.ampdata/instances/Minecraft03/Minecraft/plugins/dynmap/web/standalone/update.php on line 51" while reading response header from upstream, client: 68.149.179.1, server: map.lilasakura.ga, request: "GET /standalone/update.php?world=Cobalt&ts=1600821307956 HTTP/2.0", upstream: "fastcgi://unix:/var/run/php/php-fpm.sock:", host: "map.lilasakura.ga", referrer: "https://map.lilasakura.ga/?worldname=Cobalt&mapname=flat&zoom=1&x=52&y=64&z=226"

Example of second issue (with the path correct after my attempt to fix the first issue), I believe it is caused by a world name containing spaces (don't laugh at my world names, my daughter named them :D ), Linux seems to surround filenames automatically with single quotes if there are spaces in it when the file is created, I think when update.php runs the command to set $fname on lines 31 and 33, it will use the $world variable which probably does not contain single quotes, then when it runs $lines = file($fname); on line 51, it can't find the file, since $fname will not have the single quotes around the filename and the actual file does.

2020/09/23 23:39:42 [error] 4540#4540: *84461 FastCGI sent in stderr: "PHP message: PHP Warning:  file(/home/amp/.ampdata/instances/Minecraft03/Minecraft/plugins/dynmap/web/standalone/updates_hello new world im dino girl.php): failed to open stream: No such file or directory in /home/amp/.ampdata/instances/Minecraft03/Minecraft/plugins/dynmap/web/standalone/update.php on line 51" while reading response header from upstream, client: 68.149.179.1, server: map.lilasakura.ga, request: "GET /standalone/update.php?world=hello%20new%20world%20im%20dino%20girl&ts=1600904381405 HTTP/2.0", upstream: "fastcgi://unix:/var/run/php/php-fpm.sock:", host: "map.lilasakura.ga", referrer: "https://map.lilasakura.ga/index.html"

The actual filename stored in the standalone folder for the world mentioned in the error has single quotes around it (probably from Linux) and looks like: /home/amp/.ampdata/instances/Minecraft03/Minecraft/plugins/dynmap/web/standalone/'updates_hello new world im dino girl.php'

My attempts to correct this using if/else statements to add the ' characters in the $fname if $world contains spaces have caused dynmap to fail to update in my web browser. Here's what I tried:

if(isset($webpath)) {
  if ($world == trim($world) && strpos($world, ' ') !== false)
    $fname = $webpath . "standalone/'updates_" . $world . ".php'";
  else
    $fname = $webpath . 'standalone/updates_' . $world . '.php';
}
else {
  if ($world == trim($world) && strpos($world, ' ') !== false)
    $fname = 'updates_' . "'$world" . ".php'";
  else
    $fname = 'updates_' . $world . '.php';
}

I believe it might be failing because the if(!is_readable($fname)) code shortly after $fname is set that causes the script to return rather than continuing.

Other Relevant Data/Screenshots: Relevant section of default update.php from /web/standalone folder:


if(isset($webpath))
$fname = $webpath . '/standalone/updates_' . $world . '.php';
else
$fname = 'updates_' . $world . '.php';

if(!is_readable($fname)) { header('HTTP/1.0 404 Not Found'); return; }

$useridlc = strtolower($userid); $uid = '[' . $useridlc . ']';

if(isset($worldaccess[$world])) { $ss = stristr($worldaccess[$world], $uid); if($ss === false) { echo "{ \"error\": \"access-denied\" }"; return; } }

$lines = file($fname);


* **Steps to Replicate:**
Set up a standalone version of dynmap using Nginx, have world names in Minecraft with spaces in them. The errors for me don't appear constantly, usually I get a few each day, I'm not sure what causes update.php to run, what the code after $lines is set does and why it doesn't error constantly. I'm not even sure what these update files are for to be honest.

 [X] *I have looked at all other issues and this is not a duplicate*  
 [X] *I have been able to replicate this*

webbukkit / dynmap

PHP errors occasionally when running dynmap standalone - potential cause: world names with spaces, double forward slashes in pathnames #3137