diff --git a/htaccess-htpasswd/lang/en b/htaccess-htpasswd/lang/en
index f03c94ed0..58b330fd9 100644
--- a/htaccess-htpasswd/lang/en
+++ b/htaccess-htpasswd/lang/en
@@ -38,6 +38,8 @@ dir_eclash=This directory is already protected
 dir_edir=Missing or invalid directory
 dir_ecannot=You are not allowed to protect this directory
 dir_ecannotcreate=You are not allow to configure which directories are protected
+dir_ecannotfile=You are not allowed to use a users file in this directory
+dir_ecannotgfile=You are not allowed to use a groups file in this directory
 dir_efile=Missing or invalid users filename
 dir_ehtaccess=Failed to create Apache options file $1 : $2
 dir_ehtpasswd=Failed to create users file $1 : $2
diff --git a/htaccess-htpasswd/save_dir.cgi b/htaccess-htpasswd/save_dir.cgi
index 78260815b..06c0d872c 100755
--- a/htaccess-htpasswd/save_dir.cgi
+++ b/htaccess-htpasswd/save_dir.cgi
@@ -99,6 +99,7 @@ else {
 			}
 		}
 	-d $file && &error(&text('dir_efiledir', $file));
+	&can_access_dir($file) || &error($text{'dir_ecannotfile'});
 
 	# Parse groups file option
 	if (!$can_htgroups) {
@@ -124,6 +125,8 @@ else {
 			}
 		}
 	-d $gfile && &error(&text('dir_egfiledir', $gfile));
+	!$gfile || &can_access_dir($gfile) ||
+		&error($text{'dir_ecannotgfile'});
 
 	# Parse require option
 	@require = ( $in{'require_mode'} );