security patch for ajax.php