fixed security issue when body.profile undefined