code refactor
fixed security issue of traversing up directory tree