Security fix

Depending on your server-configuration, your photos were listed inside the upload-directory. This security-flaw is now fixed. Thanks @GustavePate for the notice.