added metadata and directory traversal checks