diff --git a/e107_admin/users.php b/e107_admin/users.php
index 003708d24..beb7d6a3e 100644
--- a/e107_admin/users.php
+++ b/e107_admin/users.php
@@ -1684,7 +1684,7 @@ class users_admin_ui extends e_admin_ui
 		}
 
 		// Make Admin.
-		if(getperms('4|U0')) // Quick Add User access should not be allowed to create new users with escalated perms. 
+		if(getperms('4|U0')) // Quick Add User access should not be allowed to create new users with escalated perms.
 		{
 			$text .= "
 			<tr>
diff --git a/e107_handlers/file_class.php b/e107_handlers/file_class.php
index 5c029b58e..c054ce12f 100644
--- a/e107_handlers/file_class.php
+++ b/e107_handlers/file_class.php
@@ -2233,6 +2233,10 @@ class e_file
 				$tmp = parse_url($targetFile);
 				$targetFile = $tmp['path'];
 				$remote = true;
+				if(!empty($tmp['host']) && ($tmp['host'] === 'localhost' || $tmp['host'] === '127.0.0.1'))
+				{
+					return false;
+				}
 			}
 
 			$ext = pathinfo($targetFile, PATHINFO_EXTENSION);
diff --git a/e107_tests/tests/unit/e_fileTest.php b/e107_tests/tests/unit/e_fileTest.php
index 89aeddbca..d92da930c 100644
--- a/e107_tests/tests/unit/e_fileTest.php
+++ b/e107_tests/tests/unit/e_fileTest.php
@@ -157,9 +157,14 @@ class e_fileTest extends \Codeception\Test\Unit
 			array('path'=> e_SYSTEM."filetypes.xml",                 'expected' => true), // permitted
 			array('path'=> e_PLUGIN."gallery/images/butterfly.jpg",  'expected' => true), // permitted
 			array('path'=> 'http://127.0.0.1:8070/file.svg',        'expected'=>false), // not permitted
-			array('path'=> 'http://127.0.0.1:8070/butterfly.jpg',   'expected'=>true), // permitted
+			array('path'=> 'http://127.0.0.1:8070/butterfly.jpg',   'expected'=>false), // not permitted
+			array('path'=> 'http://localhost:8070/file.svg',        'expected'=>false), // not permitted
+			array('path'=> 'http://localhost:8070/butterfly.jpg',   'expected'=>false), // not permitted
+			array('path'=> 'http://domain.com:8070/file.svg',        'expected'=>false), // suspicious
+			array('path'=> 'http://domain.com:8070/butterfly.jpg',   'expected'=>true), // permitted
 			array('path'=> 'http://127.0.0.1/bla.php',              'expected'=>false), // suspicious
 			array('path'=> 'http://127.0.0.1/bla.php?butterfly.jpg',   'expected'=>false), // suspicious
+
 		);
 
 		foreach($isAllowedTest as $file)