fix security for cms updater