fixed favorite security issue