		public void configure(ICourse course, CourseNode newNode, ModuleConfiguration moduleConfig) {
			
			if(displayType != null && (STCourseNodeEditController.CONFIG_VALUE_DISPLAY_TOC.equals(displayType)
					|| STCourseNodeEditController.CONFIG_VALUE_DISPLAY_PEEKVIEW.equals(displayType)
					|| STCourseNodeEditController.CONFIG_VALUE_DISPLAY_FILE.equals(displayType))) {
				moduleConfig.setStringValue(STCourseNodeEditController.CONFIG_KEY_DISPLAY_TYPE, displayType);
			}
			
			if(STCourseNodeEditController.CONFIG_VALUE_DISPLAY_FILE.equals(moduleConfig.getStringValue(STCourseNodeEditController.CONFIG_KEY_DISPLAY_TYPE))) {
				if(in != null && StringHelper.containsNonWhitespace(filename)) {
					VFSContainer rootContainer = course.getCourseFolderContainer();
					VFSLeaf singleFile = (VFSLeaf) rootContainer.resolve("/" + filename);
					if (singleFile == null) {
						singleFile = rootContainer.createChildLeaf("/" + filename);
					}
	
					moduleConfig.set(STCourseNodeEditController.CONFIG_KEY_FILE, "/" + filename);
					OutputStream out = singleFile.getOutputStream(false);
					FileUtils.copy(in, out);
					FileUtils.closeSafely(out);
					FileUtils.closeSafely(in);
				} else if (StringHelper.containsNonWhitespace(filename)) {
					VFSContainer rootContainer = course.getCourseFolderContainer();
					VFSLeaf singleFile = (VFSLeaf) rootContainer.resolve("/" + filename);
					if(singleFile != null) {
						moduleConfig.set(STCourseNodeEditController.CONFIG_KEY_FILE, "/" + filename);
					}
				}
			}
		}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.