fixed dir traversal bug