Fix bug: sercurity issues with download file function