Backport security bugfixes from 1.3 to 1.2