fixed global xss