inject file upload bug fixed