Corrected vulnerability of download.php