fixed security issue with favorite item editing