Fixed security issue where directories could still be read using '../' as GET parameter