validate that the paths are actually inside the media directory otherwise raise a 403