Include security bug fix

Fixed security bug that allowed exluding files outside form actions and templates