Fix users and groups file paths escaping the allowed directories

ⓘ Only the .htaccess path was checked against the allowed directories. The users and groups file paths could be absolute and were saved unchecked, then written to later.

V2

htaccess-htpasswd/lang/en

@@ -38,6 +38,8 @@ dir_eclash=This directory is already protected
 dir_edir=Missing or invalid directory
 dir_ecannot=You are not allowed to protect this directory
 dir_ecannotcreate=You are not allow to configure which directories are protected
+dir_ecannotfile=You are not allowed to use a users file in this directory
+dir_ecannotgfile=You are not allowed to use a groups file in this directory
 dir_efile=Missing or invalid users filename
 dir_ehtaccess=Failed to create Apache options file $1 : $2
 dir_ehtpasswd=Failed to create users file $1 : $2

htaccess-htpasswd/save_dir.cgi

@@ -99,6 +99,7 @@ else {
 			}
 		}
 	-d $file && &error(&text('dir_efiledir', $file));
+	&can_access_dir($file) || &error($text{'dir_ecannotfile'});
 
 	# Parse groups file option
 	if (!$can_htgroups) {
@@ -124,6 +125,8 @@ else {
 			}
 		}
 	-d $gfile && &error(&text('dir_egfiledir', $gfile));
+	!$gfile || &can_access_dir($gfile) ||
+		&error($text{'dir_ecannotgfile'});
 
 	# Parse require option
 	@require = ( $in{'require_mode'} );