dir traversal protection, filebrowser

security fix, as in GS filebrowser