changed widget class to use a items array
added abspath check to improve security