found & fixed another symlink attack