fix a security hole