fixed directory traversal prevention