	public function ls($hash, $intersect = null) {
		if (($dir = $this->dir($hash)) == false || !$dir['read']) {
			return false;
		}
		
		$list = array();
		$path = $this->decode($hash);
		
		$check = array();
		if ($intersect) {
			$check = array_flip($intersect);
		}
		
		foreach ($this->getScandir($path) as $stat) {
			if (empty($stat['hidden']) && (!$check || isset($check[$stat['name']])) && $this->mimeAccepted($stat['mime'])) {
				$list[$stat['hash']] = $stat['name'];
			}
		}

		return $list;
	}
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.