fix security hole in downloading