Fix another XSS