fixed potential url exploit in commands.php