It's been a while since I tried it but doesn't this also work to get you up a directory?

ExistingDir/../../parentRestrictedDir/passwords

His code seems to only check for the case where it starts with ../ of course this requires knowing of an existing directory in e current folder but that is not insurmountable for an enterprising hacker.

I'm on an iPad so I cannot check right now.

Edit: Just tried it out on my mac and it works like I remember.