aPhysical := IncludeTrailingPathDelimiter(fJail.Root) +
                        StringReplace(Copy(lCanon,2,MaxInt),'/',PathDelim,
                                      [rfReplaceAll]);
         Result := True;

{ ------------------------------------------ where a path really leads -- }

{ tSFTPJail.MapToPhysical answers from Resolve, which is LEXICAL: it cannot see
  a junction or a symbolic link, and the callers then act on the path by name.
  A link in the served tree - put there by anyone with local write access to
  it - would therefore take a request out of the root: to list, stat, remove,
  rename, make or remove a directory, or create or truncate a file. These look
  at the disk, by the jail's own rules: on Windows every link is followed and
  what was reached must lie inside the root; on POSIX a symbolic link anywhere
  below the root is refused. Neither opens an ordinary file for reading, so a
  locked or unreadable file stays within reach of stat and remove. }

{$IFDEF MSWINDOWS}
const
  cFinalPathFlags = FILE_NAME_NORMALIZED or VOLUME_NAME_DOS;

function FinalPathOfHandle(aHandle: THandle; out aPath: string): Boolean;
var
  lNeed: DWORD;
  lBuf: string;
begin
  Result := False;
  aPath := '';
  lNeed := GetFinalPathNameByHandleW(aHandle,nil,0,cFinalPathFlags);
  if (lNeed = 0) or (lNeed > 40000) then
    Exit;
  SetLength(lBuf,lNeed + 1);
  lNeed := GetFinalPathNameByHandleW(aHandle,PWideChar(lBuf),lNeed + 1,
                                     cFinalPathFlags);
  if (lNeed = 0) or (lNeed > DWORD(Length(lBuf))) then
    Exit;
  SetLength(lBuf,lNeed);
  aPath := lBuf;
  Result := True;
end;

{ Opens aPath for its attributes only, following every link, and returns where
  it leads; aError is the Windows error when it cannot be opened. }
function FinalPathOfName(const aPath: string; out aFinal: string;
                         out aError: DWORD): Boolean;
var
  lH: THandle;
  lPath: string;
begin
  Result := False;
  aFinal := '';
  lPath := aPath;
  if EndsText(':',lPath) then
    lPath := lPath + '';                    // a drive's root, not the volume
  lH := CreateFileW(PWideChar(lPath),FILE_READ_ATTRIBUTES,
                    FILE_SHARE_READ or FILE_SHARE_WRITE or FILE_SHARE_DELETE,
                    nil,OPEN_EXISTING,FILE_FLAG_BACKUP_SEMANTICS,0);
  if lH = INVALID_HANDLE_VALUE then begin
    aError := GetLastError;
    Exit;
  end;
  aError := 0;
  try
    Result := FinalPathOfHandle(lH,aFinal);
  finally
    CloseHandle(lH);
  end;
end;

{ aRoot is the jail's root as Windows reports it - the form the final paths
  come back in. }
function InsideRoot(const aRoot, aFinal: string): Boolean;
begin
  Result := SameText(aFinal,aRoot) or
            StartsText(IncludeTrailingPathDelimiter(aRoot),aFinal);
end;

{ A name that does not exist yet - a file or directory about to be created, a
  rename target - is judged by its nearest existing parent. A name that exists
  but cannot be followed, such as a link whose target is gone, is refused, and
  so is anything Windows will not open for another reason. }
function LeadsInsideRoot(const aRoot, aPhysical: string): Boolean;
var
  lProbe, lFinal: string;
  lError: DWORD;
begin
  Result := False;
  lProbe := aPhysical;
  while not FinalPathOfName(lProbe,lFinal,lError) do begin
    if ((lError <> ERROR_FILE_NOT_FOUND) and
        (lError <> ERROR_PATH_NOT_FOUND)) or
       (GetFileAttributes(PChar(lProbe)) <> INVALID_FILE_ATTRIBUTES) or
       (Length(lProbe) <= Length(aRoot)) then
      Exit;
    lProbe := ExtractFileDir(lProbe);
  end;
  Result := InsideRoot(aRoot,lFinal);
end;

{ Where a file DoOpen has just created or truncated by name really is: its
  handle is asked, not its name. }
function CreatedInsideRoot(const aRoot, aPhysical: string;
                                 aStream: TStream): Boolean;
var
  lFinal: string;
begin
  Result := (aStream is THandleStream) and
            FinalPathOfHandle(THandleStream(aStream).Handle,lFinal) and
            InsideRoot(aRoot,lFinal);
end;
{$ELSE}
{ Every name below the root, down to the first one that does not exist, must
  be a real object: a symbolic link is refused, as the jail's own walk refuses
  one - including a link whose target is gone. Nothing below a name that does
  not exist exists either, so the walk stops there. }
function LeadsInsideRoot(const aRoot, aPhysical: string): Boolean;
var
  lRootD, lPath, lPart: string;
  lSt: _stat;
  lZ: TBytes;
begin
  Result := False;
  if aPhysical = aRoot then
    Exit(True);
  lRootD := IncludeTrailingPathDelimiter(aRoot);
  if not StartsStr(lRootD,aPhysical) then
    Exit;
  lPath := ExcludeTrailingPathDelimiter(aRoot);
  for lPart in Copy(aPhysical,Length(lRootD) + 1,MaxInt).Split([PathDelim]) do begin
    if lPart = '' then
      Continue;
    lPath := lPath + PathDelim + lPart;
    lZ := PathToPosixBytes(lPath);
    if lstat(MarshaledAString(@lZ[0]),lSt) <> 0 then
      Exit(errno = ENOENT);
    if S_ISLNK(lSt.st_mode) then
      Exit;
  end;
  Result := True;
end;

{ No handle-to-name call here, so the name is walked again: a link put in the
  way since the first walk, and still there, is caught. }
function CreatedInsideRoot(const aRoot, aPhysical: string;
                                 aStream: TStream): Boolean;
begin
  Result := LeadsInsideRoot(aRoot,aPhysical);
end;
{$ENDIF}

 { ... and it must lead inside the root ON DISK, which Resolve cannot see: a
    junction or symbolic link in the tree would take it out. }
  if not LeadsInsideRoot(fJail.Root,aPhysical) then begin
    aPhysical := '';
    Exit;
  end;

     if lMode = fmCreate then
        { CREATION cannot be verified by opening - the object is not there yet,
          so there is nothing to interrogate. The jail has already confined the
          path, and the parent directory it resolved through was verified; this
          residual case is named in FileJail.txt rather than hidden. }
        lH.Stream := TFileStream.Create(lPhys,lMode)
      else if not fJail.OpenStream(lName,lWant,lH.Stream,lVerdict) then begin

     if lMode = fmCreate then begin
        { CREATION cannot be verified by opening - the object is not there yet,
          so there is nothing to interrogate beforehand. MapToPhysical has
          checked on disk that the path, or its nearest existing parent, lies
          inside the root, and what was created or truncated is checked again
          here, so a link put in the way since cannot redirect what is
          written. What such a link redirected before this check - a file
          created or truncated outside - is the residual race FileJail.txt
          names. }
        lH.Stream := TFileStream.Create(lPhys,lMode);
        if not CreatedInsideRoot(fJail.Root,lPhys,lH.Stream) then
          RaiseLastOSError({$IFDEF MSWINDOWS}ERROR_ACCESS_DENIED{$ELSE}EACCES{$ENDIF});
      end else if not fJail.OpenStream(lName,lWant,lH.Stream,lVerdict) then begin