cross directory browse bug

The variable $path has a filter bug,
the attacker can browse other directory when he send "....//....//" to server.