fix: run PATH trailing-separator check instead of dead guard

The guard meant to warn when the `PATH` constant is set but does not end
in a directory separator used `strlen(PATH) < 0`, which is never true, so
the validation never ran and a misconfigured PATH was silently accepted.
Use `strlen(PATH) > 0` so the intended error_log message is emitted.

Fixes #1887

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## 2.0.6 (not yet released)
 * CHANGED: Upgrading libraries to: DOMpurify 3.4.12
 * FIXED: Gracefully handle YOURLS replies with a 200 status code but no shorturl, instead of raising a TypeError
+* FIXED: Dead PATH validation guard in Controller, the check for a missing trailing directory separator never ran (#1887)
 
 ## 2.0.5 (2026-07-11)
 * CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)

lib/Controller.php

@@ -128,7 +128,7 @@ class Controller
             error_log(I18n::_('%s requires php %s or above to work. Sorry.', I18n::_('PrivateBin'), self::MIN_PHP_VERSION));
             return;
         }
-        if (strlen(PATH) < 0 && substr(PATH, -1) !== DIRECTORY_SEPARATOR) {
+        if (strlen(PATH) > 0 && substr(PATH, -1) !== DIRECTORY_SEPARATOR) {
             error_log(I18n::_('%s requires the PATH to end in a "%s". Please update the PATH in your index.php.', I18n::_('PrivateBin'), DIRECTORY_SEPARATOR));
             return;
         }