--- /tmp/filefield.module	2008-06-03 04:46:40.000000000 +0300
+++ filefield.module	2008-06-27 16:47:04.000000000 +0300
@@ -386,6 +386,7 @@ function filefield_widget($op, $node, $f
 }
 
 function _filefield_widget_prepare_form_values($node, $field, &$items) {
+  global $user;
   $fieldname = $field['field_name'];
   // @todo split this into its own function. determine if we can make it a form element.
   if (!count($_POST)) {
@@ -408,6 +409,13 @@ function _filefield_widget_prepare_form_
         form_set_error($field['field_name'] .'_upload', t('Files with the extension %ext are not allowed. Please upload a file with an extension from the following list: %allowed_extensions', array('%ext' => $last_ext, '%allowed_extensions' => $field['widget']['file_extensions'])));
       }
     }
+    
+    $widget_file_path = (function_exists('token_replace')) ? token_replace($field['widget']['file_path'], 'user', $user) : $field['widget']['file_path'];
+    if (!filefield_check_directory($widget_file_path)) {
+      // Include file name in upload error.
+      form_set_error(NULL, t('File upload was unsuccessful.'));
+      return FALSE;
+    }
     // let extended validation from other module happen so we get all error messages.
     // if you implement hook_filefield_file() return FALSE to stop the upload.
     if (!$valid || in_array(FALSE, module_invoke_all('filefield', 'file_validate', $node, $field, $file))) {
@@ -418,8 +426,8 @@ function _filefield_widget_prepare_form_
       $function =  $module .'_filefield';
       $function('file_prepare', $node, $field, $file);
     }
-
-    $filepath = file_create_filename($file['filename'], file_create_path($field['widget']['file_path']));
+    
+    $filepath = file_create_filename($file['filename'], file_create_path($widget_file_path));
     if (variable_get('file_downloads', FILE_DOWNLOADS_PUBLIC) == FILE_DOWNLOADS_PRIVATE) {
       if (strpos($filepath, file_directory_path()) !== FALSE) {
         $filepath = trim(substr($filepath, strlen(file_directory_path())), '\\/');