Security fix: Never suggest out-of-scope filenames in get_sugested_filename()