Enabled filename whitelisting for GFI sandbox uploads

- filename wasn't validated before exec() to unzip before