fixed a security flaw