I think it would be better to use `realpath()`on every elements of the `AllowedDeletionDirs` as well.
Regarding the comparison, checking with `!== false` is a bit buggy, e.g.:

    strpos( "/usr/share/www/", "/www/" ) // == 10

What about something like:

    if ( fnmatch( "$allowedDir/*", $dirRealPath ) )

or checking that `strpos() === 0`?