fix security bug on static/index.php