function get_show_item ($directory, $file)
{
    if ( preg_match( "/\.\./", $directory ) )
        return false;

    if ( isset($file) && preg_match( "/\.\./", $file ) )
        return false;

    // dont display own directory
    if ( $file == "." )
        return false;

    if ( substr( $file, 0, 1) == "." && $GLOBALS["show_hidden"] == false )
        return false;

    if (matches_noaccess_pattern($file))
        return false;

    if ( $GLOBALS["show_hidden"] == false )
    {
      $directory_parts = explode( "/", $directory );
      foreach ($directory_parts as $directory_part )
      {
        if ( substr ( $directory_part, 0, 1) == "." )
          return false;
      }
    }

    return true;
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.