fix path security (vulnerability: fileid='..')