protect PIMF from directory traversal attacks