fix security issue
move list and save to server side