time limit 0
fix is_dir base_dir restriction with '..'