fix security issue (add sanity for '../' in filemanager; cron task only enable for admin)