fix for directory traversal