Security issue - don't allow filtering by filter