Fixed security bug that allowed exluding files outside form actions and templates