path traversal for permissions working, although redundant code present