constructor tSFTPJail.Create(const aPhysicalRoot: string);

      if not (SameText(lFull,fRoot) or StartsText(lRootD,lFull)) then
         Exit;
       aPhysical := lFull;

{ ------------------------------------------ where a path really leads -- }

{ The name checks in tSFTPJail.MapToPhysical cannot see a junction or a
  symbolic link: Windows follows them when the path is opened, so a link inside
  the root can lead out of it. These ask Windows where a path actually leads. }

const
  cFinalPathFlags = FILE_NAME_NORMALIZED or VOLUME_NAME_DOS;

function FinalPathOfHandle(aHandle: THandle; out aPath: string): Boolean;
var
  lNeed: DWORD;
  lBuf: string;
begin
  Result := False;
  aPath := '';
  lNeed := GetFinalPathNameByHandleW(aHandle,nil,0,cFinalPathFlags);
  if (lNeed = 0) or (lNeed > 40000) then
    Exit;
  SetLength(lBuf,lNeed + 1);
  lNeed := GetFinalPathNameByHandleW(aHandle,PWideChar(lBuf),lNeed + 1,
                                     cFinalPathFlags);
  if (lNeed = 0) or (lNeed > DWORD(Length(lBuf))) then
    Exit;
  SetLength(lBuf,lNeed);
  aPath := lBuf;
  Result := True;
end;

{ Opens aPath following every link, as the server's own open does, and returns
  where it leads; aError is the Windows error when it cannot be opened. }
function FinalPathOfName(const aPath: string; out aFinal: string;
                         out aError: DWORD): Boolean;
var
  lH: THandle;
  lPath: string;
begin
  Result := False;
  aFinal := '';
  lPath := aPath;
  if (Length(lPath) = 2) and (lPath[2] = ':') then
    lPath := lPath + '';                    // a drive root, not the drive's
                                             // current directory
  lH := CreateFileW(PWideChar(lPath),FILE_READ_ATTRIBUTES,
                    FILE_SHARE_READ or FILE_SHARE_WRITE or FILE_SHARE_DELETE,
                    nil,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS,0);
  if lH = INVALID_HANDLE_VALUE then begin
    aError := GetLastError;
    Exit;
  end;
  aError := 0;
  try
    Result := FinalPathOfHandle(lH,aFinal);
  finally
    CloseHandle(lH);
  end;
end;

function InsideFinalRoot(const aRootFinal, aFinal: string): Boolean;
begin
  Result := SameText(aFinal,aRootFinal) or
            StartsText(IncludeTrailingPathDelimiter(aRootFinal),aFinal);
end;

{ True when aFull - already inside aRoot by name - also leads inside it on
  disk. A name that does not exist yet (a file or directory about to be
  created, a rename target) is judged by its nearest existing parent. A name
  that exists but cannot be followed - a link whose target is gone - is
  refused, and so is anything Windows will not open for another reason. }
function LeadsInsideRoot(const aRoot, aFull: string): Boolean;
var
  lRootFinal, lFinal, lProbe: string;
  lError: DWORD;
begin
  Result := False;
  if not FinalPathOfName(aRoot,lRootFinal,lError) then
    Exit;
  lProbe := aFull;
  while not FinalPathOfName(lProbe,lFinal,lError) do begin
    if ((lError <> ERROR_FILE_NOT_FOUND) and
        (lError <> ERROR_PATH_NOT_FOUND)) or
       (GetFileAttributesW(PWideChar(lProbe)) <> INVALID_FILE_ATTRIBUTES) or
       (Length(lProbe) <= Length(aRoot)) then
      Exit;
    lProbe := ExtractFileDir(lProbe);
  end;
  Result := InsideFinalRoot(lRootFinal,lFinal);
end;

{ The same question for a file already opened: where does its handle lead. }
function HandleInsideRoot(const aRoot: string; aHandle: THandle): Boolean;
var
  lRootFinal, lFinal: string;
  lError: DWORD;
begin
  Result := FinalPathOfName(aRoot,lRootFinal,lError) and
            FinalPathOfHandle(aHandle,lFinal) and
            InsideFinalRoot(lRootFinal,lFinal);
end;

  // It must also lead inside the jail ON DISK: a junction or symbolic link in
  // the tree would take it out.
  if not LeadsInsideRoot(fRoot,lFull) then
    Exit;

      // What was opened must lie inside the jail as well: the path was checked
      // a moment ago, by name, and a link could have been put in its way since.
      if not HandleInsideRoot(fJail.Root,lH.Stream.Handle) then
        RaiseLastOSError(ERROR_ACCESS_DENIED);