fix some XSS vulnerabilities found by coverity
Merge remote-tracking branch 'origin/4.5.2' into 4.5.2