fix security issues; work on upload module