report: prevent to download other files than report files

get_files.php must be able to download generated report files, not any
file on the system