prevent access to outside dirs