fix for LFI
fix for XSS
Merge pull request #1699 from conejoninja/fixescve

some fixes
missing default value