Fix path traversal

Adds some tests, during which I found a path traversal attack. See #377 (closed).

Merge request reports

Loading