fix grid editor xss