Valid hidden Joomla files/folders sometimes fail the filter about filter

[GeraintEdwards]

Took me a little while to figure out why case 1 was ok but not case 2.

The regexp pattern being used is

$linuxPattern = '/^[A-Za-z0-9_\/-]+[A-Za-z0-9_\.-]*([\\\\\/]+[A-Za-z0-9_-]+[A-Za-z0-9_\.-]*)*$/';

The first part of this matches all characters up to the first period
[A-Za-z0-9_\/-]+

The second part then matches up to the next 'slash'
[A-Za-z0-9_\.-]*

So the string
/var/www/vhosts/website-net/subdomain-website-net/._hiddenTemp
is covered all the way by the first 2 parts and the hidden folder is allowed.

But the string
/var/www/vhosts/website.net/subdomain.website.net/._hiddenTemp
skips to the thirs part of the regex pattern at the first slash after the first period in website.net

Then the third block won't allow the hidden prefix :(

Examining this in more detail this filter doesn't clean double dotted paths - don't know if this was intentional

/var/www/vhosts/mainsite/../another.website.net/something -> cleans to
/var/www/vhosts/mainsite/../another.website.net/something