function _download_items($dir, $items)
{
    // check if user selected any items to download
    _debug("count items: '$items[0]'");
    if (count($items) == 0)
        show_error($GLOBALS["error_msg"]["miscselitems"]);

    // check if user has permissions to download
    // this file
    if ( ! _is_download_allowed($dir, $items) )
		show_error( $GLOBALS["error_msg"]["accessitem"] );

    // if we have exactly one file and this is a real
    // file we directly download it
    if ( count($items) == 1 && get_is_file( $dir, $items[0] ) )
    {
        $abs_item = get_abs_item($dir, $items[0]);
        _download($abs_item, $items[0]);
    }

    // otherwise we do the zip download
    zip_download( get_abs_dir($dir), $items );
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.