added security fix for uploading attachments from Martin Sarsale