diff --git a/modules/system/system.admin.inc b/modules/system/system.admin.inc
index fb0664a..89e5c5a 100644
--- a/modules/system/system.admin.inc
+++ b/modules/system/system.admin.inc
@@ -1734,13 +1734,17 @@ function system_clear_page_cache_submit($form, &$form_state) {
  * @see system_settings_form()
  */
 function system_file_system_settings() {
+  $form = array(
+    '#validate' => array('system_file_system_settings_validate'),
+    '#submit' => array('system_file_system_settings_submit'),
+  );
+
   $form['file_public_path'] = array(
     '#type' => 'textfield',
     '#title' => t('Public file system path'),
     '#default_value' => variable_get('file_public_path', conf_path() . '/files'),
     '#maxlength' => 255,
     '#description' => t('A local file system path where public files will be stored. This directory must exist and be writable by Drupal. This directory must be relative to the Drupal installation directory and be accessible over the web.'),
-    '#after_build' => array('system_check_directory'),
   );
 
   $form['file_private_path'] = array(
@@ -1749,7 +1753,6 @@ function system_file_system_settings() {
     '#default_value' => variable_get('file_private_path', ''),
     '#maxlength' => 255,
     '#description' => t('A local file system path where private files will be stored. This directory must exist and be writable by Drupal. This directory should not be accessible over the web.'),
-    '#after_build' => array('system_check_directory'),
   );
 
   $form['file_temporary_path'] = array(
@@ -1758,7 +1761,6 @@ function system_file_system_settings() {
     '#default_value' => variable_get('file_temporary_path', file_directory_temp()),
     '#maxlength' => 255,
     '#description' => t('A local file system path where temporary files will be stored. This directory should not be accessible over the web.'),
-    '#after_build' => array('system_check_directory'),
   );
   // Any visible, writeable wrapper can potentially be used for the files
   // directory, including a remote file system that integrates with a CDN.
@@ -1780,6 +1782,34 @@ function system_file_system_settings() {
 }
 
 /**
+ * Checks that the private and temporary directories do not resolve to the same
+ * directory as the public directory.
+ */
+function system_file_system_settings_validate($form, &$form_state) {
+  $resolved_public_path = realpath($form['file_public_path']['#value']);
+  $resolved_private_path = realpath($form['file_private_path']['#value']);
+  $resolved_temporary_path = realpath($form['file_temporary_path']['#value']);
+
+  if ($resolved_public_path == $resolved_private_path) {
+    form_set_error('file_private_path', t('The private file system path must not be the same as the public file system path.'));
+  }
+
+  if ($resolved_public_path == $resolved_temporary_path) {
+    form_set_error('file_temporary_path', t('The temporary directory must not be the same as the public file system path.'));
+  }
+}
+
+/**
+ * Check to see if the public, private, and temporary paths exist or can be
+ * created if needed.
+ */
+function system_file_system_settings_submit($form, &$form_state) {
+  system_check_directory($form['file_public_path']);
+  system_check_directory($form['file_private_path']);
+  system_check_directory($form['file_temporary_path']);
+}
+
+/**
  * Form builder; Configure site image toolkit usage.
  *
  * @ingroup forms
diff --git a/modules/system/system.test b/modules/system/system.test
index fb6a6e8..e1eda4d 100644
--- a/modules/system/system.test
+++ b/modules/system/system.test
@@ -2149,3 +2149,52 @@ class SystemAuthorizeCase extends DrupalWebTestCase {
     $this->assertText('System Test Username');
   }
 }
+
+/**
+ * Test setting paths for the file system.
+ */
+class SystemFilePathsTestCase extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'System file paths',
+      'description' => 'Tests that protected file directories are not the same as public file directories.',
+      'group' => 'System',
+    );
+  }
+
+  function setUp() {
+    parent::setUp(array('system_test'));
+
+    // Create an administrator user.
+    $this->admin_user = $this->drupalCreateUser(array('access administration pages', 'administer site configuration'));
+    $this->drupalLogin($this->admin_user);
+  }
+
+  function testUniquePrivateDirectoryPath() {
+    $this->drupalGet('admin/config/media/file-system');
+
+    // First, test with relative directories.
+    $edit = array();
+    $edit['file_public_path'] = 'sites/default/files';
+    $edit['file_private_path'] = 'sites/default/files';
+    $edit['file_temporary_path'] = 'sites/default/files';
+
+    $this->drupalPost('admin/config/media/file-system', $edit, t('Save configuration'));
+
+    $this->assertText(t('The private file system path must not be the same as the public file system path.'), t('Relative private path is not public path.'));
+    $this->assertText(t('The temporary directory must not be the same as the public file system path.'), t('Relative temporary path is not public path.'));
+
+    // Now, test with absolute paths and "..".
+    $edit = array();
+    $edit['file_public_path'] = '/tmp/../tmp';
+    $edit['file_private_path'] = '/tmp';
+    $edit['file_temporary_path'] = '/tmp';
+
+    $this->drupalPost('admin/config/media/file-system', $edit, t('Save configuration'));
+
+    $this->assertText(t('The private file system path must not be the same as the public file system path.'), t('Absolute private path is not public path.'));
+    $this->assertText(t('The temporary directory must not be the same as the public file system path.'), t('Absolute temporary path is not public path.'));
+
+  }
+}
+