Security fix in comment controller