- Fix bug that allows a malicious server to write and overwrite any files in the quake3 directory.

Reported by Luigi Auriemma.
- Moved directory traversal check to a more proper location.
- Added a few sanity checks for checksum/pakname storage to fix a crash that can occur under certain circumstances.

code/client/cl_main.c

@@ -1444,13 +1444,6 @@ void CL_NextDownload(void) {
 		else
 			s = localName + strlen(localName); // point at the nul byte
 		
-		// Make sure the server cannot make us write to non-quake3 directories.
-		if(strstr(localName, "../") || strstr(localName, "..\\"))
-		{
-			Com_Error(ERR_DROP, "CL_NextDownload: Invalid download name %s", localName);
-			return;
-		}
-
 		CL_BeginDownload( localName, remoteName );
 
 		clc.downloadRestart = qtrue;