Pictures: don't allow the usage of /../ in thumbnail paths