url pattern for security bug fixed, breaks bug fixed