diff --git a/tftpy/TftpStates.py b/tftpy/TftpStates.py
index <HASH>..<HASH> 100644
--- a/tftpy/TftpStates.py
+++ b/tftpy/TftpStates.py
@@ -257,7 +257,7 @@ class TftpServerState(TftpState):
         full_path = os.path.join(self.context.root, pkt.filename)
         self.full_path = os.path.abspath(full_path)
         log.debug("full_path is %s" % full_path)
-        if self.context.root == full_path[:len(self.context.root)]:
+        if self.full_path.startswith(self.context.root):
             log.info("requested file is in the server root - good")
         else:
             log.warn("requested file is not within the server root - bad")
tftpy/TftpStates.py: fix security problem regarding path check

This patch fixes the request path check.  It makes sure that requested paths
are _below_ the specified root directory.