Fix possible injection in file upload.
Fix chrome upload image as first action.