Quote from: Pumaman on Wed 10/08/2005 18:51:33
Restricting to subdirectories is actually more tricky because there are various sneaky tricks that people can use to get around path checking. I'm sure you've heard of security holes in software like IIS where you can specify the path as "subdir\..\..\..\windows\system32\driver.sys" and so forth.The present method of simply disallowing / and \ characters in the path is the safest way of doing things.
Why not just disallow multiple periods? I see little need for more full stops in a file name than the one preceeding the file extension.