I fixed the last bug with forbidding addresses including ../../, but thanks to PHP syntax, this made it impossible to view a file located in a subdirectory's subdirectory. I fixed it with adding another ../ . We won't need to have additional subdirectories yet anyway.