patched pretty obvious security hole in recipe insertion