[FIX] sanitize filenames before upload