removed directory traversal