fix xss vulnerability and group widget layout