Prevents files outside the root from being detected.
Fixed remove bug when files not found.

Because $stat['realpath'] was being set, the empty($stat) check was always false after that.