int page_name_is_good(char* page_name)
{
/* We should give access only to subdirs of didiwiki root.
   I guess that check for absense of '/' is enough.

   TODO: Use realpath()
*/
    if (!page_name)
        return FALSE;

    if (!isalnum(page[0]))
        return FALSE;

    if (strstr(page, ".."))
        return FALSE;

    return TRUE;
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.