Fixed vulnerability on ajax file upload.