1 files changed, 2 insertions, 1 deletions

diff --git a/ui-plain.c b/ui-plain.c
index 27c6dae..a4ce077 100644
--- a/ui-plain.c
+++ b/ui-plain.c
@@ -39,49 +39,50 @@ static void print_object(const unsigned char *sha1, const char *path)
                 if (mime)
                         ctx.page.mimetype = (char *)mime->util;
         }
         if (!ctx.page.mimetype) {
                 if (buffer_is_binary(buf, size))
                         ctx.page.mimetype = "application/octet-stream";
                 else
                         ctx.page.mimetype = "text/plain";
         }
         ctx.page.filename = fmt("%s", path);
         ctx.page.size = size;
         ctx.page.etag = sha1_to_hex(sha1);
         cgit_print_http_headers(&ctx);
         html_raw(buf, size);
         match = 1;
 }
 
 static int walk_tree(const unsigned char *sha1, const char *base, int baselen,
                      const char *pathname, unsigned mode, int stage,
                      void *cbdata)
 {
         if (S_ISDIR(mode))
                 return READ_TREE_RECURSIVE;
 
-        if (S_ISREG(mode))
+        if (S_ISREG(mode) && !strncmp(base, match_path, baselen) &&
+            !strcmp(pathname, match_path + baselen))
                 print_object(sha1, pathname);
 
         return 0;
 }
 
 void cgit_print_plain(struct cgit_context *ctx)
 {
         const char *rev = ctx->qry.sha1;
         unsigned char sha1[20];
         struct commit *commit;
         const char *paths[] = {ctx->qry.path, NULL};
 
         if (!rev)
                 rev = ctx->qry.head;
 
         curr_rev = xstrdup(rev);
         if (get_sha1(rev, sha1)) {
                 html_status(404, "Not found", 0);
                 return;
         }
         commit = lookup_commit_reference(sha1);
         if (!commit || parse_commit(commit)) {
                 html_status(404, "Not found", 0);
                 return;