fix xml user information disclosure