closed #10 - directory traversal flaw closed