check if the cookie file is in the configured path

classes/session/file.php

@@ -300,7 +300,12 @@ protected function _read_file($session_id)
		$payload = false;

		$file = $this->config['path'].$this->config['cookie_name'].'_'.$session_id;
		if (is_file($file))

		// normalize the file
		$file = realpath($file);

		// make sure it exists and is in the config path
		if (is_file($file) and strpos($file, $this->config['path']) === 0)
		{
			$handle = fopen($file, 'r');
			if ($handle)