--- libxslt-1.1.17/libxslt/security.c.orig-unesc	2004-12-01 12:45:46 +0300
+++ libxslt-1.1.17/libxslt/security.c	2006-06-11 18:20:04 +0400
@@ -280,6 +280,57 @@
     return 1;
 }
 
+static int
+xsltCheckWritePath(xsltSecurityPrefsPtr sec,
+		   xsltTransformContextPtr ctxt,
+		   const char *path)
+{
+    int ret;
+    xsltSecurityCheck check;
+    char *directory;
+
+    check = xsltGetSecurityPrefs(sec, XSLT_SECPREF_WRITE_FILE);
+    if (check != NULL) {
+	ret = check(sec, ctxt, path);
+	if (ret == 0) {
+	    xsltTransformError(ctxt, NULL, NULL,
+			       "File write for %s refused\n", path);
+	    return(0);
+	}
+    }
+
+    directory = xmlParserGetDirectory (path);
+
+    if (directory != NULL) {
+	ret = xsltCheckFilename(directory);
+	if (ret == 0) {
+	    /*
+	     * The directory doesn't exist check for creation
+	     */
+	    check = xsltGetSecurityPrefs(sec,
+					 XSLT_SECPREF_CREATE_DIRECTORY);
+	    if (check != NULL) {
+		ret = check(sec, ctxt, directory);
+		if (ret == 0) {
+		    xsltTransformError(ctxt, NULL, NULL,
+				       "Directory creation for %s refused\n",
+				       path);
+		    xmlFree(directory);
+		    return(0);
+		}
+	    }
+	    ret = xsltCheckWritePath(sec, ctxt, directory);
+	    if (ret == 1)
+		ret = mkdir(directory, 0755);
+	}
+	xmlFree(directory);
+	if (ret < 0)
+	    return(ret);
+    }
+
+    return(1);
+}
+
 /**
  * xsltCheckWrite:
  * @sec:  the security options
@@ -310,49 +361,14 @@
     }
     if ((uri->scheme == NULL) ||
 	(xmlStrEqual(BAD_CAST uri->scheme, BAD_CAST "file"))) {
-	char *directory;
 
 	/*
 	 * Check if we are allowed to write this file
 	 */
-	check = xsltGetSecurityPrefs(sec, XSLT_SECPREF_WRITE_FILE);
-	if (check != NULL) {
-	    ret = check(sec, ctxt, uri->path);
-	    if (ret == 0) {
-		xsltTransformError(ctxt, NULL, NULL,
-			     "File write for %s refused\n", URL);
-		xmlFreeURI(uri);
-		return(0);
-	    }
-	}
-
-	directory = xmlParserGetDirectory (uri->path);
-	if (directory != NULL) {
-	    ret = xsltCheckFilename(directory);
-	    if (ret == 0) {
-		/*
-		 * The directory doesn't exist check for creation
-		 */
-		check = xsltGetSecurityPrefs(sec,
-				 XSLT_SECPREF_CREATE_DIRECTORY);
-		if (check != NULL) {
-		    ret = check(sec, ctxt, directory);
-		    if (ret == 0) {
-			xsltTransformError(ctxt, NULL, NULL,
-					 "Directory creation for %s refused\n",
-					 URL);
-			xmlFree(directory);
-			xmlFreeURI(uri);
-			return(0);
-		    }
-		}
-		ret = xsltCheckWrite(sec, ctxt, (const xmlChar *)directory);
-		if (ret == 1)
-		    ret = mkdir(directory, 0755);
-		if (ret < 0)
-		    return(ret);
-	    }
-	    xmlFree(directory);
+	ret = xsltCheckWritePath(sec, ctxt, uri->path);
+	if (ret <= 0) {
+	    xmlFreeURI(uri);
+	    return(ret);
 	}
     } else {
 	/*
