diff --git a/lib/bug-files-check.php b/lib/bug-files-check.php
index ff2a001..af70f31 100644
--- a/lib/bug-files-check.php
+++ b/lib/bug-files-check.php
@@ -12,8 +12,10 @@ $maxLines	= $_GET['maxLines'];
 $result = "ok";
 
 for ($i=0; $i<count($files); $i++) {
-	$files[$i] = $_SERVER['DOCUMENT_ROOT'].$files[$i];
-	if (!file_exists($files[$i])) {
+	// Work out the real path for a file
+	$files[$i] = realpath($_SERVER['DOCUMENT_ROOT'].$files[$i]);
+	// If we can't find that file or it doesn't start with the doc root, it's an error
+	if (!file_exists($files[$i]) || strpos($files[$i],$_SERVER['DOCUMENT_ROOT']) !== 0) {
 		$result = "error";
 	} else {
 		$filesSizesSeen[$i] = filesize($files[$i]);