fixed extension security bug