listing.php: bugfix: #5

Fixed directory traversal vulnerability