Fixed a security issue in filename path handling.

It was possible to specify a full path filename with / or \, causing a security issue when downloading (system file overwrite, ...)