[griffin] closed up script injection security hole in response to issue #1