dir traversal works now