Fix search controller security bug