fixed security vulnerability; thx to gstark