fix a scripting security issue