'Guard against arbitrary file retrieval.'

def _is_under_root(self, full_path):

    if (path.abspath(full_path) + path.sep).startswith((path.abspath(self.root) + path.sep)):
        return True
    else:
        return False
