Fix #409 media-file-renamer XSS