#1 Path check on presence ".."

[Anonymous]

File: download.php
It seems to me that instead of string:
if(strpos($fullfilename,"..")==true){

Should be:
if(strpos($fullfilename,'..')!==false){

For example: function strpos ('./path/file.zip ', '. ') will return 0 which it will be transformed to false

[Nobody/Anonymous]

Sorry: function strpos ('../path/file.zip ', '. ') will return 0 which
it will be transformed to false