diff --git a/core/modules/system/system.admin.inc b/core/modules/system/system.admin.inc
index 97a4673..a020844 100644
--- a/core/modules/system/system.admin.inc
+++ b/core/modules/system/system.admin.inc
@@ -1753,13 +1753,17 @@ function system_clear_page_cache_submit($form, &$form_state) {
  * @see system_settings_form()
  */
 function system_file_system_settings() {
+  $form = array(
+    '#validate' => array('system_file_system_settings_validate'),
+    '#submit' => array('system_file_system_settings_submit'),
+  );
+
   $form['file_public_path'] = array(
     '#type' => 'textfield',
     '#title' => t('Public file system path'),
     '#default_value' => variable_get('file_public_path', conf_path() . '/files'),
     '#maxlength' => 255,
     '#description' => t('A local file system path where public files will be stored. This directory must exist and be writable by Drupal. This directory must be relative to the Drupal installation directory and be accessible over the web.'),
-    '#after_build' => array('system_check_directory'),
   );
 
   $form['file_private_path'] = array(
@@ -1768,7 +1772,6 @@ function system_file_system_settings() {
     '#default_value' => variable_get('file_private_path', ''),
     '#maxlength' => 255,
     '#description' => t('An existing local file system path for storing private files. It should be writable by Drupal and not accessible over the web. See the online handbook for <a href="@handbook">more information about securing private files</a>.', array('@handbook' => 'http://drupal.org/handbook/modules/file')),
-    '#after_build' => array('system_check_directory'),
   );
 
   $form['file_temporary_path'] = array(
@@ -1777,7 +1780,6 @@ function system_file_system_settings() {
     '#default_value' => variable_get('file_temporary_path', file_directory_temp()),
     '#maxlength' => 255,
     '#description' => t('A local file system path where temporary files will be stored. This directory should not be accessible over the web.'),
-    '#after_build' => array('system_check_directory'),
   );
   // Any visible, writeable wrapper can potentially be used for the files
   // directory, including a remote file system that integrates with a CDN.
@@ -1799,6 +1801,34 @@ function system_file_system_settings() {
 }
 
 /**
+ * Checks that the private and temporary directories do not resolve to the same
+ * directory as the public directory.
+ */
+function system_file_system_settings_validate($form, &$form_state) {
+  $resolved_public_path = realpath($form['file_public_path']['#value']);
+  $resolved_private_path = realpath($form['file_private_path']['#value']);
+  $resolved_temporary_path = realpath($form['file_temporary_path']['#value']);
+
+  if ($resolved_public_path == $resolved_private_path) {
+    form_set_error('file_private_path', t('The private file system path must not be the same as the public file system path.'));
+  }
+
+  if ($resolved_public_path == $resolved_temporary_path) {
+    form_set_error('file_temporary_path', t('The temporary directory must not be the same as the public file system path.'));
+  }
+}
+
+/**
+ * Check to see if the public, private, and temporary paths exist or can be
+ * created if needed.
+ */
+function system_file_system_settings_submit($form, &$form_state) {
+  system_check_directory($form['file_public_path'], FALSE);
+  system_check_directory($form['file_private_path'], TRUE);
+  system_check_directory($form['file_temporary_path'], TRUE);
+}
+
+/**
  * Form builder; Configure site image toolkit usage.
  *
  * @ingroup forms
diff --git a/core/modules/system/system.module b/core/modules/system/system.module
index 77d6ebf..411e956 100644
--- a/core/modules/system/system.module
+++ b/core/modules/system/system.module
@@ -2158,8 +2158,11 @@ function system_admin_menu_block($item) {
  *
  * @param $form_element
  *   The form element containing the name of the directory to check.
+ * @param $private
+ *   If $private is TRUE, create a htaccess file configured for secure access
+ *   in the directory specified in $form_element.
  */
-function system_check_directory($form_element) {
+function system_check_directory($form_element, $private = TRUE) {
   $directory = $form_element['#value'];
   if (strlen($directory) == 0) {
     return $form_element;
@@ -2183,7 +2186,7 @@ function system_check_directory($form_element) {
     }
     else {
       // Create private .htaccess file.
-      file_save_htaccess($directory);
+      file_save_htaccess($directory, $private);
     }
   }
 
diff --git a/core/modules/system/system.test b/core/modules/system/system.test
index 4e3761d..3a19ef2 100644
--- a/core/modules/system/system.test
+++ b/core/modules/system/system.test
@@ -2600,3 +2600,51 @@ class UuidUnitTestCase extends DrupalUnitTestCase {
 
   }
 }
+
+/*
+ * Test setting paths for the file system.
+ */
+class SystemFilePathsTestCase extends DrupalWebTestCase {
+  public static function getInfo() {
+    return array(
+      'name' => 'System file paths',
+      'description' => 'Tests that protected file directories are not the same as public file directories.',
+      'group' => 'Module',
+    );
+  }
+
+  function setUp() {
+    parent::setUp(array('system_test'));
+
+    // Create an administrator user.
+    $this->admin_user = $this->drupalCreateUser(array('access administration pages', 'administer site configuration'));
+    $this->drupalLogin($this->admin_user);
+  }
+
+  function testUniquePrivateDirectoryPath() {
+    $this->drupalGet('admin/config/media/file-system');
+
+    // First, test with relative directories.
+    $edit = array();
+    $edit['file_public_path'] = 'sites/default/files';
+    $edit['file_private_path'] = 'sites/default/files';
+    $edit['file_temporary_path'] = 'sites/default/files';
+
+    $this->drupalPost('admin/config/media/file-system', $edit, t('Save configuration'));
+
+    $this->assertText(t('The private file system path must not be the same as the public file system path.'), t('Relative private path is not public path.'));
+    $this->assertText(t('The temporary directory must not be the same as the public file system path.'), t('Relative temporary path is not public path.'));
+
+    // Now, test with absolute paths and "..".
+    $edit = array();
+    $edit['file_public_path'] = '/tmp/../tmp';
+    $edit['file_private_path'] = '/tmp';
+    $edit['file_temporary_path'] = '/tmp';
+
+    $this->drupalPost('admin/config/media/file-system', $edit, t('Save configuration'));
+
+    $this->assertText(t('The private file system path must not be the same as the public file system path.'), t('Absolute private path is not public path.'));
+    $this->assertText(t('The temporary directory must not be the same as the public file system path.'), t('Absolute temporary path is not public path.'));
+
+  }
+}
+