            foreach ($fields as $field => $title) {
                if($i==0 && $j==0){
                    echo '<div class="row">';
                }elseif($i==0 && $j>0){
                    echo '</div><div class="row">';
                }
                echo '<div class="col-md-6"><label class="checkbox-inline"><INPUT type=checkbox onclick="addHTML(\'<LI>' . $title . '</LI>\',\'names_div\',false);addHTML(\'<INPUT type=hidden name=fields[' . $field . '] value=Y>\',\'fields_div\',false);addHTML(\'\',\'names_div_none\',true);this.disabled=true">' . $title . '<label></div>';
                
                /*if ($i % 2 == 0)
                    echo '</TR><TR>';*/
                $i++;
                if($i==2){
                    $i = 0;
                }
                $j++;
            }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.