	public static function pathFile($path, $file=false)
	{
		if($file!==false){
			$fullPath = $path.$file;
		}
		else {
			$fullPath = $path;
		}

		// Fix for Windows on paths. eg: $path = c:\diego/page/subpage convert to c:\diego\page\subpages
		$fullPath = str_replace('/', DS, $fullPath);

		if(CHECK_SYMBOLIC_LINKS) {
			$real = realpath($fullPath);
		}
		else {
			$real = file_exists($fullPath)?$fullPath:false;
		}

		// If $real is FALSE the file does not exist.
		if($real===false) {
			return false;
		}

		// If the $real path does not start with the systemPath then this is Path Traversal.
		if(strpos($fullPath, $real)!==0) {
			return false;
		}

		return true;
	}
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.