file upload and som bugs found by Mr.hu