fix some directory traversal bug