fix security issue (thank to Zerdoumi for reporting it)