Security patch (files must stay in workdir)

Clean path in filemanager for prevent null bytes injection & go out of workdir