Master

library/Class/FileManager.php

@@ -21,9 +21,12 @@
class Class_FileManager {
public function isAuthorized($path) {
-    return Class_Users::isCurrentUserCanAccesBackend()
-      && false !== strpos($path, USERFILESURL)
-      && false === strpos($path, '..');
+    if (!Class_Users::isCurrentUserCanAccesBackend()
+        || false === strpos($path, USERFILESURL))
+      return false;
+
+    $parts = explode('/', $path);
+    return !in_array('..', $parts);
}
}