fix xss
Merge branch 'hotfix'