some dir traversal fixes