Fixed XSS vunerability in groups