fix path traversal vulnerability as reported by http://blog.k3170makan.com/2014/02/path-disclosure-vulnerability-in-io.html