fixes to #9600 security flaw