Fixed XSS in "change column" functionality