bug: wrong indentation made script injection fail