moved the $_recursion conditional in get_filenames() to fix a bug where a bad submitted path would result in the system using / as the source directory.
diff --git a/system/helpers/file_helper.php b/system/helpers/file_helper.php
index 7eb93da..e1a4ff3 100644
--- a/system/helpers/file_helper.php
+++ b/system/helpers/file_helper.php
@@ -168,17 +168,16 @@
 	function get_filenames($source_dir, $include_path = FALSE, $_recursion = FALSE)

 	{

 		static $_filedata = array();

-		

-		// reset the array and make sure $source_dir has a trailing slash on the initial call

-		if ($_recursion === FALSE)

-		{

-			$_filedata = array();

-			$source_dir = realpath($source_dir).'/';

-		}

-		

-		

+				

 		if ($fp = @opendir($source_dir))

 		{

+			// reset the array and make sure $source_dir has a trailing slash on the initial call

+			if ($_recursion === FALSE)

+			{

+				$_filedata = array();

+				$source_dir = realpath($source_dir).'/';

+			}

+			

 			while (FALSE !== ($file = readdir($fp)))

 			{

 				if (@is_dir($source_dir.$file) && substr($file, 0, 1) != '.')