Fixed possible XSS when trying to upload files with bad names.