2 files changed, 10 insertions, 7 deletions

diff --git a/data.c b/data.c
index 9abfeb8..992a42f 100644
--- a/data.c
+++ b/data.c
@@ -2673,14 +2673,17 @@ static int _load_raw_file(const char *fn, xs_val **data, int *size,
             }
             else {
                 /* newer or never downloaded; read the full file */
+                struct stat sb;
                 FILE *f;
 
-                if ((f = fopen(fn, "rb")) != NULL) {
-                    *size = XS_ALL;
-                    *data = xs_read(f, size);
-                    fclose(f);
+                if (lstat(fn, &sb) == 0 && (sb.st_mode&S_IFMT) == S_IFREG) {
+                    if ((f = fopen(fn, "rb")) != NULL) {
+                        *size = XS_ALL;
+                        *data = xs_read(f, size);
+                        fclose(f);
 
-                    status = HTTP_STATUS_OK;
+                        status = HTTP_STATUS_OK;
+                    }
                 }
             }
 
@@ -2699,7 +2702,7 @@ static int _load_raw_file(const char *fn, xs_val **data, int *size,
 xs_str *_static_fn(snac *snac, const char *id)
 /* gets the filename for a static file */
 {
-    if (strchr(id, '/'))
+    if (strstr(id, ".."))
         return NULL;
     else
         return xs_fmt("%s/static/%s", snac->basedir, id);
diff --git a/html.c b/html.c
index a261ae4..122bfee 100644
--- a/html.c
+++ b/html.c
@@ -5073,7 +5073,7 @@ int html_get_handler(const xs_dict *req, const char *q_path,
     }
     else
     if (xs_startswith(p_path, "s/")) { /** a static file **/
-        xs *l    = xs_split(p_path, "/");
+        xs *l    = xs_split_n(p_path, "/", 1);
         const char *id = xs_list_get(l, 1);
         int sz;