See #2: Added a path check to make sure the path requested is not in a parent folder of the server root folder.