From 6c44dd4bb8e4f2ca5f135f172de4725b2cada155 Mon Sep 17 00:00:00 2001
From: David <39418842+CheeseCake87@users.noreply.github.com>
Date: Wed, 6 Nov 2024 17:47:57 +0000
Subject: [PATCH] update helpers.send_from_directory docstring (#5599)

Update helpers.send_from_directory docstring to match werkzeug.utils.send_from_directory docstring on the :param directory: line.
---
 src/flask/helpers.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/flask/helpers.py b/src/flask/helpers.py
index f891eed126..57c8a00054 100644
--- a/src/flask/helpers.py
+++ b/src/flask/helpers.py
@@ -547,7 +547,8 @@ def download_file(name):
     raises a 404 :exc:`~werkzeug.exceptions.NotFound` error.
 
     :param directory: The directory that ``path`` must be located under,
-        relative to the current application's root path.
+        relative to the current application's root path. This *must not*
+        be a value provided by the client, otherwise it becomes insecure.
     :param path: The path to the file to send, relative to
         ``directory``.
     :param kwargs: Arguments to pass to :func:`send_file`.